> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sync certificates to Palo Alto Networks

> Deploy certificates to the certificate store of PAN-OS firewalls and Panorama templates.

A Palo Alto Networks sync imports certificates and their private keys into the certificate store of a PAN-OS firewall or a Panorama template, then commits the change.

For a certificate that a service on the device uses, such as the management web interface or a GlobalProtect portal, use a [Palo Alto Networks SSL/TLS Profile sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks-ssl-tls-profile.md) instead. It also sets the certificate on the service's SSL/TLS service profile.

## Prerequisites

* An [application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) that holds the certificates to deploy
* A [Palo Alto Networks connection](https://infisical.com/docs/integrations/app-connections/palo-alto-networks.md) to the firewall or Panorama
* On a Panorama, a template
* To push to firewalls, a template stack that contains the template
* Certificates that include a private key

> [!NOTE]
>
> Each certificate the sync deploys needs its private key, because a firewall service can't use a certificate without it. The issuing CA certificates the sync imports alongside don't need theirs. If a certificate was issued from a CSR generated elsewhere, for example by an agent that keeps the key on its own host, the sync can't deploy it and skips it.

## Create a sync

> [tab] Infisical UI
>
> **Step 1**
>
> In your application, open the **Certificate Syncs** tab and select **Add Sync**.
>
> **Step 2**
>
> Select **Palo Alto Networks**.
>
> **Step 3**
>
> Configure the destination, then select **Continue**:
>
> * **Palo Alto Networks Connection**: the connection to the firewall or Panorama
> * **Template** (Panorama only): the template to import the certificates into
> * **Push to Devices** (Panorama only): whether the sync pushes the committed changes to firewalls (on by default)
>
> **Step 4**
>
> Configure the sync options, then select **Continue**:
>
> * **Remove certificates from destination**: delete a certificate from the device when it's no longer active in Infisical
> * **Preserve certificate on renewal**: replace the certificate in place when it's renewed (see [Certificate renewal](#certificate-renewal))
> * **Certificate name schema**: the name of each certificate object on the device, up to 31 characters (use `{{shortCertificateId}}` rather than `{{certificateId}}`, which is too long; see [Certificate name schema](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-name-schema))
> * **Auto-sync on change**: sync certificates as soon as they're issued or renewed
>
> **Step 5**
>
> Enter a **Name** and an optional **Description** for the sync, then select **Continue**.
>
> **Step 6**
>
> Select which certificates the sync holds, then select **Continue**.
>
> **Step 7**
>
> Review the configuration and select **Create Sync**.

> [tab] API
>
> To create a Palo Alto Networks sync, make an API request to the [Create Palo Alto Networks PKI sync](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/create.md) endpoint.
>
> > [!NOTE]
> >
> > Pass `filters` to describe the certificates this sync holds. If a certificate in the application matches the filters, it's attached to the sync as soon as it's issued. If you omit `filters`, the sync starts empty and you can set filters later.
> > See [Certificate filters](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-filters).
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl --request POST \
> --url https://app.infisical.com/api/v1/cert-manager/syncs/palo-alto-networks \
> --header 'Authorization: Bearer <access-token>' \
> --header 'Content-Type: application/json' \
> --data '{
>     "name": "my-panorama-cert-sync",
>     "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>     "description": "Branch firewall certificates",
>     "connectionId": "550e8400-e29b-41d4-a716-446655440000",
>     "isAutoSyncEnabled": true,
>     "filters": {
>         "certificateOrderIds": ["550e8400-e29b-41d4-a716-446655440000"]
>     },
>     "syncOptions": {
>         "canRemoveCertificates": true,
>         "preserveItemOnRenewal": true,
>         "certificateNameSchema": "INF-{{shortCertificateId}}"
>     },
>     "destinationConfig": {
>         "template": "branch-template",
>         "pushToDevices": true
>     }
> }'
> ```
>
> ### Sample response
>
> ```json Response theme={"dark"}
> {
>     "pkiSync": {
>         "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "name": "my-panorama-cert-sync",
>         "description": "Branch firewall certificates",
>         "destination": "palo-alto-networks",
>         "isAutoSyncEnabled": true,
>         "destinationConfig": {
>             "template": "branch-template",
>             "pushToDevices": true
>         },
>         "syncOptions": {
>             "canRemoveCertificates": true,
>             "preserveItemOnRenewal": true,
>             "certificateNameSchema": "INF-{{shortCertificateId}}"
>         },
>         "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "connectionId": "550e8400-e29b-41d4-a716-446655440000",
>         "createdAt": "2026-10-08T00:00:00.000Z",
>         "updatedAt": "2026-10-08T00:00:00.000Z"
>     }
> }
> ```

## How it works

Each time it runs, the sync:

* Imports each certificate and its private key into the shared certificate store of the firewall, or of the selected template on a Panorama
* Imports the issuing CA certificates as separate objects named `INF-CA-<fingerprint>`, skipping any already on the device
* Commits only the changes made by the connection's administrator account, so pending changes from other administrators stay uncommitted
* On a Panorama with **Push to Devices** on, pushes every template stack that contains the template to its firewalls

> [!NOTE]
>
> A push also sends changes that other administrators committed on Panorama for those template stacks but haven't pushed yet. To push on your own schedule, turn off **Push to Devices**.

## Certificate renewal

When a certificate is renewed, the result depends on **Preserve certificate on renewal**:

* **On (default)**: the sync replaces the certificate object in place, so anything that references it by name uses the renewed certificate
* **Off**: the sync creates a new certificate object, and deletes the old one only if **Remove certificates from destination** is on

## Removing certificates

If **Remove certificates from destination** is on, the sync deletes the certificate object of a certificate that's no longer active in Infisical. The CA certificate objects stay on the device.

PAN-OS doesn't delete a certificate that's still in use, such as by an SSL/TLS service profile. If that happens, the sync shows the PAN-OS error. Remove the reference on the device, then sync again.

## Manual sync

To remove certificates on demand, use the [Remove certificates from Palo Alto Networks](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/remove-certificates.md) endpoint. To sync on demand, use the [Sync certificates to Palo Alto Networks](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/sync-certificates.md) endpoint.

## FAQ

> [accordion] Can I import certificates from a Palo Alto Networks device into Infisical?
>
> No. Palo Alto Networks syncs only deploy certificates from Infisical to the device.

## Next steps

> [card] [Palo Alto Networks SSL/TLS profile](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks-ssl-tls-profile.md)
>
> Use a synced certificate in an SSL/TLS service profile.

> [card] [Renewal](https://infisical.com/docs/documentation/platform/pki/applications/certificate-renewal.md)
>
> Renew a certificate, and change its details as part of the renewal.

> [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)
>
> Get notified about certificate lifecycle events.

> [card] [Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)
>
> View all supported sync destinations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.