Palo Alto Networks Knowledgebase: How to Generate a CSR (Certificate Signing Request) & Import the Signed Certificate
How to Generate a CSR (Certificate Signing Request) & Import the Signed Certificate
Created On 02/07/19 23:50 PM - Last Updated 02/07/19 23:50 PM
PAN-OS includes a feature to create a Certificate Signing Request (CSR). This feature can create a Certificate Signing Request (CSR) for sending to a public third-party Certificate Authority like Verisign, Globalsign, Entrust, and so on...
Generate the CSR
Go to Device > Certificate Management > Certificates. Certificate screen in PAN-OS 6.0,6.1 and 7.0Certificate screen in PAN-OS 7.1
Click 'Generate' at the bottom of the screen. PAN-OS 6.0, 6.1 and 7.0PAN-OS 7.1
Fill in the Certificate Name (save this name for later), Common Name (usually the FQDN), and select "External Authority (CSR)" for Signed By. Note:Do not select 'Certificate Authority.' PAN-OS 7.1 Generate Certificate screen
Complete the remaining details such as Country, Organization, and so on. Check with the Certificate Authority (CA) about their requirements for Certificate Attribute formatting and criteria. Click Generate to create the CSR.
You should see the confirmation window when this is complete. Certificate confirmation window - PAN-OS 7.1
Export the CSR
You will need to export the CSR to send to a third-party CA for signature:
Click the check box next to the Certificate Name or any whitespace on that line to select it. Exporting CSR on PAN-OS 7.1
Click Export and save the file.
Send the exported CSR to a third-party Certificate Authority. The CA will respond with a signed certificate.
Import the Signed Certificate
Note the name, including capitalization, of the certificate to import. (This must match the CSR request from above.)
Click the Import option at the bottom of the screen. Import certificate option PAN-OS 7.1
In the Import Certificate dialog, type the name of the pending certificate. It must match exactly. Import Certificate window PAN-OS 7.1
Click browse to select the signed certificate received from the Certificate Authority and click OK. (Note: Do not click the Import Private Key check box as the private key is already on the firewall).