Palo Alto Networks PAN-OS

Firewall and VPN

Imports the certificate and key, repoints SSL/TLS service profiles and commits.

What happens

The appliance connects to Palo Alto Networks PAN-OS through PAN-OS XML API on port 443.
The certificate, key and intermediates are imported as objects.
The service profiles point at the new certificate and the change is committed. If it fails: Rollback puts the profiles' previous references back and commits again.
Verification: the package checks certificate name and fingerprint against running references, exported content and known served TLS chains.

Connection: The package runs on the appliance, which connects over HTTPS to PAN-OS XML API, port 443. No agent is installed.
You need: API key for the PAN-OS XML API.
Platform: PAN-OS 9.1 and later on firewalls; Panorama templates are not supported
Actions: Discovery, Installation, Verification, Rollback, Removal
Packages: paloalto-panos-api 1.3.1
Note: Discovery finds running certificates, fingerprints, profile bindings, the management profile and HA state. Rollback uses the deployment backup and refuses conflicts with later changes.
RSA and ECDSA P-256/P-384 are supported. The certificate and private key are imported together into a new certificate object; only the selected SSL/TLS service profiles in shared or the selected vsys are changed. The previous object is preserved when switching between RSA and ECDSA, so rollback can restore the previous profile references.
Palo Alto Networks: https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/keys-and-certificates
PALOALTO_VERIFY_ENDPOINTS can select TLS targets for deployment and verify, including on Alpine/musl. Supply comma-separated host:port or host:port@sni entries, up to 8 endpoints and 600 characters in total. An empty field retains known endpoints from discovery.