Certificate generated on the firewall with "Block Private Key Export" checked allows key export after certificate renewal

• Certificate is generated with "Block Private Key Enabled" and this is confirmed in the certificate listing.

• After you renew the certificate, notice the missing icon that would indicate that the private key can be exported

• This can be confirmed by trying to export the renewed certificate

• Palo Alto Firewall.
• Supported PAN-OS 
• Certificates

There is a workaround in place to disable certificate export on certificate renewal:

1. Renew the certificate
2. Export it out of the firewall
3. Disable private key export when you reimport the certificate

Refer to Block Private Key Export for details.