---
title: "Configure Palo Alto"
slug: "clm-configure-palo-alto"
updated: 2026-11-06T17:31:04Z
published: 2026-11-06T17:31:04Z
canonical: "docs.senhasegura.io/clm-configure-palo-alto"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Palo Alto

This document provides information on how to configure the Palo Alto publishing profile to make it possible to install and publish certificates.

If the Palo Alto device is not directly reachable from Segura® Platform, the profile publishes through the Network Connector configured on the device.

## Requirements

- A certificate generated and signed by a CA. More information in [How to create a request](/v4-2/docs/certificates-flow-how-to-requisitions) and [How to sign a request](/v4-2/docs/certificates-flow-how-to-sign-request).
- A credential registered in Segura® with access to the Palo Alto device. More information in [How to configure a credential in Segura®](/v4-2/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura).
- A device registered in Segura® for the Palo Alto firewall. More information in [How to configure a device](/v4-2/docs/pam-device-configure-device).  

If the device is not directly reachable from Segura® Platform, configure a Network Connector on the device before creating the profile. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment.
- An HTTPS connectivity on the device. The default port is 443. Without it, the publication fails with the error `Equipment without HTTPS connectivity`.

## How the publication works

Segura® publishes the certificate through the PAN-OS XML API over HTTPS:

1. Generates an API key with the credential.
2. Imports the certificate and its private key as a PKCS12 keypair.
3. Sets the certificate on the SSL/TLS profile entered in the **SSL/TLS profile** field.
4. Commits the configuration on the firewall automatically.

The certificate name on the firewall is derived from the certificate's common name (CN): `*` is replaced by `wildcard`, invalid characters are replaced by `_`, and the name is truncated to 31 characters.

## Configure Palo Alto

To configure Palo Alto, see the following steps:

1. On Segura®, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**.
2. In the side menu, select **Publishing** > **Publishing profiles**.
3. In the actions button, select **Palo Alto**.
4. In the **Settings** tab, enter the following information:
  1. In the **Profile name ***, enter the profile's name.
  2. In the **Credential username**, enter the credential's name.
  3. Optional: Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura® to be used.
5. Click **Continue**.
6. In the **Palo Alto** tab, enter the following fields:
  1. In the **SSL/TLS profile** field, enter the SSL/TLS profile's name. A new name creates a profile; an existing name changes that profile's settings. If you leave this field empty, Segura® imports the certificate but cannot link it to an SSL/TLS profile, and you must link it manually on the firewall.
  2. Optional: In the **Min version** dropdown menu, select the oldest TLS protocol version the device accepts: **TLSv1.0**, **TLSv1.1**, or **TLSv1.2**.
  3. Optional: In the **Max version** dropdown menu, select the latest TLS protocol version the device accepts: **TLSv1.0**, **TLSv1.1**, **TLSv1.2**, or **Max**. The maximum version must be equal to or later than the minimum version. TLS 1.3 is not available.
7. Click **Continue**.
8. In the **Devices** tab, select the Palo Alto device.
  1. The device must be previously registered in Segura®.
  2. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured.
9. In the **Review** tab, review all information entered previously, and click **Save**.

## Verify your results

The Palo Alto plugin does not run a post-publication verification step. Check the certificate directly on the Palo Alto device to confirm the publication succeeded.

If the device's Network Connector is unreachable or misconfigured, the plugin does not raise a dedicated error message. The operation fails with a generic exception instead. The only Network-Connector-specific trace is a log line (`Network Connector: <agent>`), recorded when the connection was routed through it.

More information in [How to publish a certificate](/v4-2/docs/certificates-flow-how-to-publish-a-certificate).