> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sync certificates to Palo Alto Networks > Deploy certificates to the certificate store of PAN-OS firewalls and Panorama templates. A Palo Alto Networks sync imports certificates and their private keys into the certificate store of a PAN-OS firewall or a Panorama template, then commits the change. For a certificate that a service on the device uses, such as the management web interface or a GlobalProtect portal, use a [Palo Alto Networks SSL/TLS Profile sync](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks-ssl-tls-profile.md) instead. It also sets the certificate on the service's SSL/TLS service profile. ## Prerequisites * An [application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) that holds the certificates to deploy * A [Palo Alto Networks connection](https://infisical.com/docs/integrations/app-connections/palo-alto-networks.md) to the firewall or Panorama * On a Panorama, a template * To push to firewalls, a template stack that contains the template * Certificates that include a private key > [!NOTE] > > Each certificate the sync deploys needs its private key, because a firewall service can't use a certificate without it. The issuing CA certificates the sync imports alongside don't need theirs. If a certificate was issued from a CSR generated elsewhere, for example by an agent that keeps the key on its own host, the sync can't deploy it and skips it. ## Create a sync **Infisical UI** **Step 1** In your application, open the **Certificate Syncs** tab and select **Add Sync**. **Step 2** Select **Palo Alto Networks**. **Step 3** Configure the destination, then select **Continue**: * **Palo Alto Networks Connection**: the connection to the firewall or Panorama * **Template** (Panorama only): the template to import the certificates into * **Push to Devices** (Panorama only): whether the sync pushes the committed changes to firewalls (on by default) **Step 4** Configure the sync options, then select **Continue**: * **Remove certificates from destination**: delete a certificate from the device when it's no longer active in Infisical * **Preserve certificate on renewal**: replace the certificate in place when it's renewed (see [Certificate renewal](#certificate-renewal)) * **Certificate name schema**: the name of each certificate object on the device, up to 31 characters (use `{{shortCertificateId}}` rather than `{{certificateId}}`, which is too long; see [Certificate name schema](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-name-schema)) * **Auto-sync on change**: sync certificates as soon as they're issued or renewed **Step 5** Enter a **Name** and an optional **Description** for the sync, then select **Continue**. **Step 6** Select which certificates the sync holds, then select **Continue**. **Step 7** Review the configuration and select **Create Sync**. **API** To create a Palo Alto Networks sync, make an API request to the [Create Palo Alto Networks PKI sync](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/create.md) endpoint. > [!NOTE] > > Pass `filters` to describe the certificates this sync holds. If a certificate in the application matches the filters, it's attached to the sync as soon as it's issued. If you omit `filters`, the sync starts empty and you can set filters later. > See [Certificate filters](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-filters). ### Sample request ```bash Request theme={"dark"} curl --request POST \ --url https://app.infisical.com/api/v1/cert-manager/syncs/palo-alto-networks \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "name": "my-panorama-cert-sync", "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", "description": "Branch firewall certificates", "connectionId": "550e8400-e29b-41d4-a716-446655440000", "isAutoSyncEnabled": true, "filters": { "certificateOrderIds": ["550e8400-e29b-41d4-a716-446655440000"] }, "syncOptions": { "canRemoveCertificates": true, "preserveItemOnRenewal": true, "certificateNameSchema": "INF-{{shortCertificateId}}" }, "destinationConfig": { "template": "branch-template", "pushToDevices": true } }' ``` ### Sample response ```json Response theme={"dark"} { "pkiSync": { "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a", "name": "my-panorama-cert-sync", "description": "Branch firewall certificates", "destination": "palo-alto-networks", "isAutoSyncEnabled": true, "destinationConfig": { "template": "branch-template", "pushToDevices": true }, "syncOptions": { "canRemoveCertificates": true, "preserveItemOnRenewal": true, "certificateNameSchema": "INF-{{shortCertificateId}}" }, "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", "connectionId": "550e8400-e29b-41d4-a716-446655440000", "createdAt": "2026-10-08T00:00:00.000Z", "updatedAt": "2026-10-08T00:00:00.000Z" } } ``` ## How it works Each time it runs, the sync: * Imports each certificate and its private key into the shared certificate store of the firewall, or of the selected template on a Panorama * Imports the issuing CA certificates as separate objects named `INF-CA-`, skipping any already on the device * Commits only the changes made by the connection's administrator account, so pending changes from other administrators stay uncommitted * On a Panorama with **Push to Devices** on, pushes every template stack that contains the template to its firewalls > [!NOTE] > > A push also sends changes that other administrators committed on Panorama for those template stacks but haven't pushed yet. To push on your own schedule, turn off **Push to Devices**. ## Certificate renewal When a certificate is renewed, the result depends on **Preserve certificate on renewal**: * **On (default)**: the sync replaces the certificate object in place, so anything that references it by name uses the renewed certificate * **Off**: the sync creates a new certificate object, and deletes the old one only if **Remove certificates from destination** is on ## Removing certificates If **Remove certificates from destination** is on, the sync deletes the certificate object of a certificate that's no longer active in Infisical. The CA certificate objects stay on the device. PAN-OS doesn't delete a certificate that's still in use, such as by an SSL/TLS service profile. If that happens, the sync shows the PAN-OS error. Remove the reference on the device, then sync again. ## Manual sync To remove certificates on demand, use the [Remove certificates from Palo Alto Networks](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/remove-certificates.md) endpoint. To sync on demand, use the [Sync certificates to Palo Alto Networks](https://infisical.com/docs/api-reference/endpoints/pki/syncs/palo-alto-networks/sync-certificates.md) endpoint. ## FAQ > **Can I import certificates from a Palo Alto Networks device into Infisical?** > > No. Palo Alto Networks syncs only deploy certificates from Infisical to the device. ## Next steps > **[Palo Alto Networks SSL/TLS profile](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks-ssl-tls-profile.md)** > > Use a synced certificate in an SSL/TLS service profile. > **[Renewal](https://infisical.com/docs/documentation/platform/pki/applications/certificate-renewal.md)** > > Renew a certificate, and change its details as part of the renewal. > **[Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)** > > Get notified about certificate lifecycle events. > **[Certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)** > > View all supported sync destinations. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.