Panorama cert replacement via API.
Panorama cert replacement via API.
So I have had this script I have been working on for a while, intended to automate LetsEncrypt renewals and deploy those certs to Panorama for Palo Alto endpoints.
I have had some success by brute-forcing the process. Delete pubkey and privkey, then replace. This is problematic if any of those certs are being used in objects though.
Is there an API mechanism anyone is aware of, XML or REST, than can be used to replace a cert currently being utilized in objects?
Or is the mechanism really only to deploy to a whole new entry, and switch the SSL profile to that new one? That's the only other path forward I can currently see, and it feels like extra work.
Is the delete needed? From the ClickOps GUI perspective, when you update a cert for renewal, you import the renewed cert with the same object name and it automatically overwrites the object.
There is an API endpoint for Palos, but it's probably not as robust as the GUI. I wouldn't know, I've never used it except for monitoring tool configs.Edit: looks like there is a REST API endpoint for cert/private key changes: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sYecCAE&lang=en_US &refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail
Oh shit, first set of examples for the REST docs shows importing s combined keypair! That would solve the keypair mismatch when importing one at a time.
Solid! 👊
Makes sense, you can do the same with the GUI if you import it as an encrypted .pem with the public and private key in the same file.
Yeah if I don't delete the existing keys when uploading new ones, i get a keypair mismatch.
I will take a look at the REST docs, thanks!
What version are you on?