Palo Alto | Forcing Device Certificates to Use the Newer Intermediate Certificate

There are situations where Palo Alto device certificates used for the Web Interface or GlobalProtect and issued by 3rd party PKI servers such as ADCS will expire because their root CA or intermediate CA certificates are also expiring. In these cases, the certificates must be renewed.

However, there is a minor bug in Palo Alto devices: if two intermediate certificates share the same issuer (the root CA) but have different expiration dates, all imported certificates from that issuer will incorrectly be associated with the older intermediate certificate.

For example:

A Palo Alto firewall is using a 3rd PKI (Microsoft ADCS) to issue private certificates for the Web Console and GlobalProtect portals/gateways. Palo Alto contains the following certificates installed under Device > Certificate Management > Certificates

Root CA
    Old Intermediate Cert    To be expired soon/already expired
        Current Global Protect cert   To be expired soon/already expired
        Current Firewall 1 Management Cert    To be expired soon/already expired
        Current Firewall 2 Management Cert    To be expired soon/already expired
        Future Global Protect    Expires later date
        Future Firewall 1 Management Cert    Expires later date
        Future Firewall 2 Management Cert    Expires later date
    New Intermediate Cert    Expires later date

As you probably noticed, all Certs are issued by the Old Intermediate Cert which breaks the certificate chain for the future certs.

In order to force the cert to be issued by the new New Intermediate Cert we need to do 2 steps:

1. Make sure the option Trusted Root CA is disabled in the Old Intermediate Cert

2.  On the Palo Alto CLI and using configuration mode, execute this command to force deletion of the Old Intermediate Cert 
delete shared certificate {name of the Old Intermediate Cert}

After doing those steps the new device Certificates structure under Device > Certificate Management > Certificates will look like this:

Root CA
    New Intermediate Cert    Expires later date
        Current Global Protect cert   To be expired soon/already expired
        Current Firewall 1 Management Cert    To be expired soon/already expired
        Current Firewall 2 Management Cert    To be expired soon/already expired
        Future Global Protect    Expires later date
        Future Firewall 1 Management Cert    Expires later date
        Future Firewall 2 Management Cert    Expires later date
   

Which means that Certificate chain is now correct and we can proceed in change SSL/TLS service profile certs corresponding for Global Protect and Management.