csr attributes that are required or optional

 

CN	Common   Name	This is the fully qualified domain name (FQDN) that specifies the server’s exact location in the Domain Name System (DNS). For example, a component with hostname webBridge1 and parent domain example.com has the fully qualified domain name webBridge1.example.com. The FQDN uniquely distinguishes the component from any other components called webBridge1 in other domains.	Required, see notes below
O	Organization or Business name	Usually the legal incorporated name of a company. It should include any suffixes such as Ltd., Inc., or Corp. Use “” around the attribute if more than one word, e.g. “Example Inc.”	Optional
OU	Organizational unit or Department name	For example, Support, IT, Engineering, Finance. Use “” around the attribute if more than one word, e.g. “Human Resources”	Optional
L	Location	City or town. For example, London, Boston, Milan, Berlin.	Optional
ST	Province, Region, County or State	For example, Buckinghamshire, California. Do not abbreviate. Use “” around the attribute if more than one word, e.g. “New Jersey”	Optional
C	Country	The two-letter ISO code for the country where your organization is located. For example, US, GB, FR.	Optional
An email address		An email address to contact the organization. Usually the email address of the certificate administrator or IT department.	Optional
SAN	Subject Alternative Name	From X509 Version 3 (RFC 2459), SSL certificates are allowed to specify multiple names that the certificate should match. This field enables the generated certificate to cover multiple domains. It can contain IP addresses, domain names, email addresses, regular DNS host names, etc, separated by commas. If you specify this list you must also include the CN in this list. Although this is an optional field, the SAN field must be completed in order for XMPP clients to accept a certificate, otherwise the XMPP clients will display a certificate error.	Required   for XMPP server certificates or if a single certificate is to be used across   multiple components.  See note below. Note: XMPP server is not supported from version 3.0

issue importing or renewing cert on palo alto firewall

Replacing/renew an existing wildcard cert

You need the .pfx cert with private key bundle

cert password

name the new cert "cert_name_of_existing_cert" or something new "cert_may_2026"

In palo select the cert

click import

choose pkcs12, choose the .pfx file

enter the password

import and commit

Don't forget update the SSL profile (a bit below certs) with the new cert 

Test the GP web interface

When trying to import a cert with the private key bundled you get an error:

Import of certificate and private-key CERT-NAME failed. private key doesn't exist for csr.

Importing the signed cert with the same name as the CSR doesn't work. Panorama adds cert_ to the front of the name

You need to port cert_ in front for example if cert is called CERT-NAME you put cert_CERT-NAME

CSR import

Import the CA bundle if not done already

If you make duplicates will have to delete on CLI

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kHyVCAU&lang=en_US%E2%80%A9

tick your pending CSR

click import 

give the same name as your csr request 

select the pem file

PEM file format

ok

commit

Importing SAML cert

Create new cert and make it active 

Delete old/inactive cert

Wait a few minutes for cloud to do its thing

Download the .xml files

In palo delete old certs and commit

Going into SAML IDP provider

Import 

Untick validate checkbox

This will import the cert and create a saml profile

User your new saml profile in your auth sequence 

Test connection to GP etc

SSL cert decorder

https://www.sslshopper.com

Digicert have an application you can download for windows too

openssl can be used on linux

read csr information in linux

Extract information from the CSR

$ openssl req -in shellhacks.com.csr -text -noout

Verify the signature

$ openssl req -in shellhacks.com.csr -noout -verify

Whom the certificate will be issued to?

$ openssl req -in shellhacks.com.csr -noout -subject

Show the public key

$ openssl req -in shellhacks.com.csr -noout -pubkey