No "certificate used by" field when generating certs for SSL forward trust and untrust?

[K.Graves221717]

I'm configuring a SSL decryption POC and I'm running into an issue where when I generate or import a certificate for either my forward trust or untrust cert, I don't see a field to specify that I want this cert to be used for those purposes.  In the documention, I see this:

For Certificate Use For, select Forward Untrust Certificate.

But I never see this field while I'm generating the cert and after I've generated it, I see that field, but it's grayed out.

I'm running PANOS-11.2.4-h11 on a 1410 pair, if that helps.  ETA - I have tried also logging in as the local admin as well as my radius login.  Still no fields.

Thanks in advance!

[CosminM · Accepted solution]

Hello @K.Graves221717 

When you generate your certificates for signing trusted or untrusted SSL connections you need to enable the Certificate Authority. Only a Certificate Authority certificate can resign other certificates.

After you generate click again on your new certificate and you should be able to enable Forward Trust.

Repeat the procedure to generate another certificate and activate as Forward Untrust.

[K.Graves221717]

Thank you so much!  That did the trick!