> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Palo Alto Networks SSL/TLS profile
> Deploy a certificate to a PAN-OS firewall or Panorama template and set it on an SSL/TLS service profile.
A Palo Alto Networks SSL/TLS Profile sync deploys one certificate to a PAN-OS firewall or a Panorama template, then sets it as the certificate of an existing SSL/TLS service profile. Use it for services that take their certificate from a profile, such as the management web interface or a GlobalProtect portal.
To deploy several certificates without changing a profile, use a [Palo Alto Networks sync](/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks) instead.
## Prerequisites
* An [application](/docs/documentation/platform/pki/applications/overview) that holds the certificate to deploy
* A [Palo Alto Networks connection](/docs/integrations/app-connections/palo-alto-networks) to the firewall or Panorama
* On a Panorama, a template
* To push to firewalls, a template stack that contains the template
* An SSL/TLS service profile on the firewall or in the template, either shared or in a virtual system
## Create a sync
In your application, open the **Certificate Syncs** tab and select **Add Sync**.
Select **Palo Alto Networks SSL/TLS Profile**.
Configure the destination, then select **Continue**:
* **Palo Alto Networks Connection**: the connection to the firewall or Panorama
* **Template** (Panorama only): the template to import the certificate into
* **SSL/TLS Service Profile**: the profile that uses the synced certificate
* **Push to Devices** (Panorama only): whether the sync pushes the committed changes to firewalls (on by default)
Configure the sync options, then select **Continue**:
* **Remove certificates from destination**: delete the old certificate from the device when it's replaced or no longer active in Infisical
* **Preserve certificate on renewal**: replace the certificate in place when it's renewed (see [Certificate renewal](#certificate-renewal))
* **Certificate name schema**: the name of the certificate object on the device, up to 31 characters (use `{{shortCertificateId}}` rather than `{{certificateId}}`, which is too long)
* **Auto-sync on change**: sync the certificate as soon as it's issued or renewed
Enter a **Name** and an optional **Description** for the sync, then select **Continue**.
Select the **Certificate Order** the sync holds, then select **Continue**. A certificate order is a certificate together with its renewals.
Review the configuration and select **Create Sync**.
To create a Palo Alto Networks SSL/TLS Profile sync, make an API request to the [Create Palo Alto Networks SSL/TLS Profile PKI sync](/docs/api-reference/endpoints/pki/syncs/palo-alto-networks-ssl-tls-profile/create) endpoint.
In `destinationConfig`, set `sslTlsServiceProfileName` to the name of the profile. If the profile belongs to a virtual system, also set `sslTlsServiceProfileVsys`, such as `vsys1`. Leave `sslTlsServiceProfileVsys` out for a shared profile.
Pass `filters` to describe the certificate this sync holds. The filters must match a single certificate or certificate order. If you omit `filters`, the sync starts empty and you can set filters later.
See [Certificate filters](/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-filters).
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "gp-portal-cert-sync",
"applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "GlobalProtect portal certificate",
"connectionId": "550e8400-e29b-41d4-a716-446655440000",
"isAutoSyncEnabled": true,
"filters": {
"certificateOrderIds": ["550e8400-e29b-41d4-a716-446655440000"]
},
"syncOptions": {
"canRemoveCertificates": true,
"preserveItemOnRenewal": true,
"certificateNameSchema": "INF-{{shortCertificateId}}"
},
"destinationConfig": {
"template": "branch-template",
"pushToDevices": true,
"sslTlsServiceProfileName": "gp-portal-profile",
"sslTlsServiceProfileVsys": "vsys1"
}
}'
```
### Sample response
```json Response expandable theme={"dark"}
{
"pkiSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "gp-portal-cert-sync",
"description": "GlobalProtect portal certificate",
"destination": "palo-alto-networks-ssl-tls-profile",
"isAutoSyncEnabled": true,
"destinationConfig": {
"template": "branch-template",
"pushToDevices": true,
"sslTlsServiceProfileName": "gp-portal-profile",
"sslTlsServiceProfileVsys": "vsys1"
},
"syncOptions": {
"canRemoveCertificates": true,
"preserveItemOnRenewal": true,
"certificateNameSchema": "INF-{{shortCertificateId}}"
},
"applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2026-10-08T00:00:00.000Z",
"updatedAt": "2026-10-08T00:00:00.000Z"
}
}
```
## How it works
Each time it runs, the sync imports the certificate the same way a [Palo Alto Networks sync](/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks#how-it-works) does, then sets it as the profile's certificate. The sync doesn't create the profile or change its other settings.
## Certificate renewal
When the certificate is renewed, the result depends on **Preserve certificate on renewal**:
* **On (default)**: the sync replaces the certificate object in place, so the profile keeps using it
* **Off**: the sync creates a new certificate object, switches the profile to it, and deletes the old one only if **Remove certificates from destination** is on
## Removing the certificate
PAN-OS won't delete a certificate that a profile still uses. When you switch the sync to another certificate order, the sync moves the profile to the new certificate first, then deletes the old one.
To remove the certificate without switching orders, pick a **Replacement Certificate** from the device. The field appears in **Remove Certificates**, and when you save an edit that drops the certificate. The sync moves the profile to the replacement, then deletes the synced certificate. Through the API, pass `removalOptions.replacementCertificateName` to the [Remove certificates](/docs/api-reference/endpoints/pki/syncs/palo-alto-networks-ssl-tls-profile/remove-certificates) or [Update](/docs/api-reference/endpoints/pki/syncs/palo-alto-networks-ssl-tls-profile/update) endpoint.
Without a replacement, the edit isn't saved and **Remove Certificates** fails. The certificate stays on the device.
## Manual sync
To sync on demand, use the [Sync certificates to Palo Alto Networks SSL/TLS Profile](/docs/api-reference/endpoints/pki/syncs/palo-alto-networks-ssl-tls-profile/sync-certificates) endpoint.
## FAQ
Yes. Each sync updates one profile, so create one sync for each profile.
## Next steps
Deploy certificates to the certificate store without changing a profile.
Renew a certificate, and change its details as part of the renewal.
Get notified about certificate lifecycle events.
View all supported sync destinations.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.