How to Generate a CSR (Certificate Signing Request) & Import the Signed Certificate

Environment

• PAN-OS 7.1 and above.

• Palo Alto Firewall.

Resolution

PAN-OS includes a feature to create a Certificate Signing Request (CSR). This feature can create a Certificate Signing Request (CSR) for sending to a public third-party Certificate Authority like Verisign, Globalsign, Entrust, and so on...

Steps

Generate the CSR

1. Go to  Device > Certificate Management > Certificates.

   

2. Click 'Generate' at the bottom of the screen.

3. Fill in the Certificate Name (save this name for later), Common Name (usually the FQDN), and select "External Authority (CSR)" for Signed By.
   Note:   Do not select 'Certificate Authority.'

4. Complete the remaining details such as Country, Organization, and so on. Check with the Certificate Authority (CA) about their requirements for Certificate Attribute formatting and criteria. Click Generate to create the CSR.

5. You should see the confirmation window when this is complete.

Export the CSR

You will need to export the CSR to send to a third-party CA for signature:

1. Click the checkbox next to the Certificate Name or any whitespace on that line to select it.

Note : Newer PAN-OS will display  Export Certificate  instead of  Export

2. Click  Export or Export Certificate  and save the file.

3. Send the exported CSR to a third-party Certificate Authority. The CA will respond with a signed certificate.

Import the Signed Certificate

1. Note the name, including capitalization, of the certificate to import. ( This must match the CSR request from above.)

2. Click the Import option at the bottom of the screen.

3. In the Import Certificate dialog, type the name of the pending certificate. It  must match  exactly.

4. Click browse to select the signed certificate received from the Certificate Authority and click OK.
   ( Note : Do  not  click the Import Private Key checkbox as the private key is already on the firewall).

5. Depending on the certificate authority used, it may be necessary to chain the intermediate certificate with the server certificate and import it before completing this step. For more information, refer  How to Install a Chained Certificate Signed by a Public CA .

6. Click OK. The certificate now appears valid and the key checkbox is selected. (CA checkbox will remain empty as it is not valid for this example.)