P
Prisma Access Toolbox
/
PAN Certificate Management
1
Find missing trusted root CAs
Compare against the Chrome Root Store only (uncheck for the full CCADB set)
Find missing certificates
Root CA
Fingerprint (SHA-256)
Device name
2
Scan decryption logs
Firewall / Panorama
Look back
6 hours
24 hours
3 days
7 days
Scan decryption logs
Root CA
Sessions
Sample SNI
Confidence
3
Upload missing certificates
Only certificates found in decryption logs (recommended)
All missing certificates
Dry run — show exactly what would be sent, change nothing
Preview
Import to candidate
Commit
Device name
Root CA
Status