: Panorama can be used to centrally install device certificates across multiple managed firewalls simultaneously.
If your firewall cannot connect to Palo Alto's services, the fetch will fail. Ensure the following are configured: palo alto fetch device certificate
| Error | Solution | |-------|----------| | Connection refused | Check firewall outbound access to certificate.paloaltonetworks.com | | CA not trusted | Import Palo Alto Networks Root CA under Device → Certificates | | Serial number mismatch | Use the exact chassis serial number (from show system info ) | | Expired device certificate | Fetch a new one before the old expires; no reboot required | : Panorama can be used to centrally install
: Execute the command request certificate fetch otp . palo alto fetch device certificate