Palo Alto Networks SSL/TLS profile

A Palo Alto Networks SSL/TLS Profile sync deploys one certificate to a PAN-OS firewall or a Panorama template, then sets it as the certificate of an existing SSL/TLS service profile. Use it for services that take their certificate from a profile, such as the management web interface or a GlobalProtect portal. To deploy several certificates without changing a profile, use a Palo Alto Networks sync instead.

Prerequisites

An application that holds the certificate to deploy
A Palo Alto Networks connection to the firewall or Panorama
On a Panorama, a template
To push to firewalls, a template stack that contains the template
An SSL/TLS service profile on the firewall or in the template, either shared or in a virtual system

Create a sync

Infisical UI
API

In your application, open the Certificate Syncs tab and select Add Sync.

Select Palo Alto Networks SSL/TLS Profile.

Configure the destination, then select Continue:

Palo Alto Networks Connection: the connection to the firewall or Panorama
Template (Panorama only): the template to import the certificate into
SSL/TLS Service Profile: the profile that uses the synced certificate
Push to Devices (Panorama only): whether the sync pushes the committed changes to firewalls (on by default)

Configure the sync options, then select Continue:

Remove certificates from destination: delete the old certificate from the device when it’s replaced or no longer active in Infisical
Preserve certificate on renewal: replace the certificate in place when it’s renewed (see Certificate renewal)
Certificate name schema: the name of the certificate object on the device, up to 31 characters (use {{shortCertificateId}} rather than {{certificateId}}, which is too long)
Auto-sync on change: sync the certificate as soon as it’s issued or renewed

Enter a Name and an optional Description for the sync, then select Continue.

Select the Certificate Order the sync holds, then select Continue. A certificate order is a certificate together with its renewals.

Review the configuration and select Create Sync.

To create a Palo Alto Networks SSL/TLS Profile sync, make an API request to the Create Palo Alto Networks SSL/TLS Profile PKI sync endpoint.In destinationConfig, set sslTlsServiceProfileName to the name of the profile. If the profile belongs to a virtual system, also set sslTlsServiceProfileVsys, such as vsys1. Leave sslTlsServiceProfileVsys out for a shared profile.

Pass filters to describe the certificate this sync holds. The filters must match a single certificate or certificate order. If you omit filters, the sync starts empty and you can set filters later. See Certificate filters.

Sample request

Request

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "gp-portal-cert-sync",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "GlobalProtect portal certificate",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "isAutoSyncEnabled": true,
    "filters": {
        "certificateOrderIds": ["550e8400-e29b-41d4-a716-446655440000"]
    },
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveItemOnRenewal": true,
        "certificateNameSchema": "INF-{{shortCertificateId}}"
    },
    "destinationConfig": {
        "template": "branch-template",
        "pushToDevices": true,
        "sslTlsServiceProfileName": "gp-portal-profile",
        "sslTlsServiceProfileVsys": "vsys1"
    }
}'

Sample response

Response

{
    "pkiSync": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "gp-portal-cert-sync",
        "description": "GlobalProtect portal certificate",
        "destination": "palo-alto-networks-ssl-tls-profile",
        "isAutoSyncEnabled": true,
        "destinationConfig": {
            "template": "branch-template",
            "pushToDevices": true,
            "sslTlsServiceProfileName": "gp-portal-profile",
            "sslTlsServiceProfileVsys": "vsys1"
        },
        "syncOptions": {
            "canRemoveCertificates": true,
            "preserveItemOnRenewal": true,
            "certificateNameSchema": "INF-{{shortCertificateId}}"
        },
        "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "550e8400-e29b-41d4-a716-446655440000",
        "createdAt": "2026-10-08T00:00:00.000Z",
        "updatedAt": "2026-10-08T00:00:00.000Z"
    }
}

How it works

Each time it runs, the sync imports the certificate the same way a Palo Alto Networks sync does, then sets it as the profile’s certificate. The sync doesn’t create the profile or change its other settings.

Certificate renewal

When the certificate is renewed, the result depends on Preserve certificate on renewal:

On (default): the sync replaces the certificate object in place, so the profile keeps using it
Off: the sync creates a new certificate object, switches the profile to it, and deletes the old one only if Remove certificates from destination is on

Removing the certificate

PAN-OS won’t delete a certificate that a profile still uses. When you switch the sync to another certificate order, the sync moves the profile to the new certificate first, then deletes the old one. To remove the certificate without switching orders, pick a Replacement Certificate from the device. The field appears in Remove Certificates, and when you save an edit that drops the certificate. The sync moves the profile to the replacement, then deletes the synced certificate. Through the API, pass removalOptions.replacementCertificateName to the Remove certificates or Update endpoint. Without a replacement, the edit isn’t saved and Remove Certificates fails. The certificate stays on the device.

Manual sync

To sync on demand, use the Sync certificates to Palo Alto Networks SSL/TLS Profile endpoint.

FAQ

Can several profiles use the same certificate?

Yes. Each sync updates one profile, so create one sync for each profile.

Next steps