Readme

Welcome to Palo Alto Networks Trust Protection Foundation version 26.2. This product was formerly named Venafi Trust Protection Platform.

What’s new in 26.2

Trust Protection Foundation 26.2 introduces several powerful new features to help you solve your most important business problems related to managing and protecting machine identities within your organization today. Read about new 26.2 features here.

Product Documentation Changes

We are currently migrating all product documentation to the Network Security section of Palo Alto Networks’ TechDocs (http://docs.paloaltonetworks.com).

Effective Date: Ongoing. While we finalize the migration over the coming months, documentation is temporarily hosted across multiple sites.

Where to find your documentation:

Action Required: Please bookmark the relevant links above for your products.

Thank you for your patience as we migrate to Palo Alto Networks’ TechDocs platform.

Trust Protection Foundation documentation

In addition to this documentation portal, you can also find product documentation in the following locations:

  • From the Help link in the web interface, and in the Configuration Console.
  • On a Windows Server where you’ve installed Trust Protection Foundation, click the Start menu, and then type Trust Protection Foundation.
  • From the Installation Guide.lnk file included in the zip package, launch the HTML Help version of the Installation Guide.
  • Download the PDF versions of the documentation.
  • On your test instance of Trust Protection Foundation. For testing REST API calls, Swagger documentation is only available in your own instance of Trust Protection Foundation. For example: https://YourTestInstance/vedsdk. For more information, see the Developers Guide.

Product verification

Palo Alto Networks utilizes cryptographic techniques and best practices to ensure authorship of the Palo Alto Networks products that you install. The software ensures that the installation media, which originated from Palo Alto Networks, and the data and media is not compromised.

To verify RPM signing of our Linux clients:

Installation

Before installing Trust Protection Foundation or the Server Agent, carefully review the system requirements and prepare your servers as described in the Trust Protection Foundation Installation Guide.

An HTML-based version of the Installation Guide is provided in the Trust Protection Foundation zip archive for those users who are unable to reach the public documentation server from within their server environment.

Take a look at the instructions on installing Trust Protection Foundation for the first time.

Upgrading from a previous release

IMPORTANT! Before upgrading to the new version, carefully review the article “Important Considerations before Upgrading”.

Review the instructions on upgrading from a previous version of Trust Protection Foundation, including information on supported upgrade paths, database upgrade scripts (if required), and upgrade steps.

Versioning

Review information about the current MIS release model, including the duration of engineering support for this release.

Resolved issues in 26.2

Palo Alto Networks fixed the following issues in this release of Trust Protection Foundation.

Issues resolved in Trust Protection Foundation 26.2

ID Description
#91269, #91384, #91385, #91386 Stage 500 approval screen shows the certificate object algorithm instead of the user-provided CSR algorithm.
#90322 Teams are not updating correctly when users are removed from the Policy Tree.
#90088 A long-running script can thread-starve worker threads.

Driver Integrations issues resolved in 26.2

ID Description
#90086 Debug logging is not thread-safe.

Code Sign Manager - Self-Hosted (formerly CodeSign Protect) issues resolved in 26.2

ID Description
#90253 Orphan active pre-approval when adding during pending approval.
#90016 CodeSign Client missing MMC snap-in start menu shortcut after installing CSC 25.3.0.
#88373 On a new installation, no default Flow is assigned for Environment deletion.

Security updates in 26.2

This release fixes a number of security-related issues. The number of issues fixed in each of the following severity categories is shown in the table below.

Critical High Medium Low
0 2 6 3

Palo Alto Networks will not release any additional information about the security-related issues in this release. Use these numbers to help you as you make decisions about your timeline for upgrading.

Known issues in 26.2

This section documents unresolved issues that you might encounter.

Trust Protection Foundation known issues

ID Description
#75346 Certificate discovery glob exclude doesn’t include sub-pattern match.
#74273 Limited users with Platform access can’t see all Platform product menu items.
#75646 When trying to import root that’s in the Recycle Bin, and ‘already existing’ error is displayed.
#66824 Owner of a team doesn’t have permissions to delete team.
#51434 LDAP driver needs mechanism to add user-defined attributes to be returned.
#70370 Name and Description not being displayed on Reason Codes.
#91418 Error when switching DB account to gMSA: Could not switch to service account context.
#91130 PKCS12 with unsupported encryption algorithm cannot be consumed by certificate credential.

Certificate Manager - Self-Hosted known issues

ID Description
#79849 Accessing Workflow > Requests > Pending shows “The resource you have requested is unavailable due to an exception” message.
#73902 Applications for bound certificates without common name are discovered every time the job runs (Netscaler).
#73345 Idira Vault (formerly CyberArk Vault) connector can be deleted in VCC even when there are credential objects that use it.
#75433 API allowed users who were not set as an approver to approve workflows.
#67880 Some log events are not capturing X-Forwarded-For info.
#64316 Database Error due to Always-On Availability Group when mirroring/syncing is running or service broker is not running.
#67644 SAN values are not updated during subsequent re-discoveries of certificates if the SAN values were updated outside of TPP. The resulting in auto-renewals use SAN values stored in TPP.
#68813 Certificate renewal from CSR in Aperture broken if you edit the renewal details first.
#64817 When you paste text into the Search bar, the results do not automatically populate.
#78404 SID identity selector allows to select multiple identities using Ctrl+A.

Server Agent known issues

ID Description
#44035 If a certificate that was issued by Dynamic Provisioning work is in an error stage, changing the Dynamic Provisioning work configuration will not fix the certificate that is in error.

Workaround: Either delete the existing certificate object OR change the value in the Object Naming Pattern field. This effectively creates a new Certificate object in the Policy tree.
#44036 When Server Agent checks in and gets the Dynamic Provisioning work, Agent only checks to see if the Keystore content still matches what Trust Protection Foundation sends down to the agent without checking whether the private key content matches. Whenever Keystore content is replaced, private key content is replaced on the agent, as well.
#44037 When a Server Agent Device object is in the same policy folder as the requested certificate and the Object Naming Pattern value is set to ‘Client.DNSName’, a naming collision occurs. Therefore, a certificate object cannot be created, and the certificate will not be requested. Configuration does not allow two objects with the same name to co-exist in the same policy folder. In addition, device names should be unique.
#36259 Sometimes when you make changes to groups, the slow response causes No work created or not found for a group, even though it was created for the group. The error clears within 10 minutes.

SSH Manager for Machines known issues

ID Description
#75152 SSH Network Discovery won’t start with max work units defined.
#74461 Rotation of .pub options get removed.

Driver Integrations known issues

ID Description
#88704 Cannot enroll certificates with MSCA if using external communicator attribute on the CA template.
#64668 If Citrix NetScaler is provisioning to a high availability device while the secondary node offline, provisioning fails.
#37799 After the F5 parent profile changes, and a second F5 Onboard Discovery job runs, the parent profile changes are missing.
#33098 Provisioning fails for GSK8 if remote generation is used in tandem with Replace Existing.
#65315 Application as consumers using Adaptable credential for private key/ keystore credential: In cases of ps1 hash mismatch, the credential is treated as empty password.
#86059 Adding new certificate installation in Aperture shows redundant installation types.
#86097 Default description is being set even when the description field is empty during the creation of an Idira Vault connector in VCC.
#86211 Canceled stated of a Netscaler OD job is not displayed correctly, showing Complete instead.
#86169 PKCS12 keystore provisioning fails when bundle contains only blacklisted certificates.
#86617 JKS provisioning on Windows device with remote generation fails on stage 200.
#89654 HydrantID: certificates are not being renewed; a new certificate is always issued instead.
#89329 [Amazon App] If “Certificate Issued By AWS Certificate Manager” is set to true, the setting cannot be saved with the default “No Binding” selection.

Code Sign Manager known issues

ID Description
#86116 Environment view for a disabled environment shows text saying it’s enabled when it isn’t.
#86115 After restoring an environment from the Recycle Bin and clicking “Enable,” the ticket for the enable request says both Current and Proposed are Enabled. Current should say Disabled.
#82311 CodeSign benchmark tool GUI version not updated.
#80252 Selecting Credentials > Create and Certificates > Create in code signing just shows CA Connectors to create - not credentials or certificates.
#79574 Project Search on second page does not reset page to first so you cannot see search results.
#79573 Bulk Environment Edit modal gets cut off screen and not scrollable on mass edit.
#78731 Project Search doesn’t highlight or filter on specific symbols.
#78114 Invalid certificate file on import produces many different error messages on spam.
#77964 Some tickets can’t be deleted once they have processed once, resulting in orphaned active approvals.
#76594 Multi-stage approvals not appearing in the web console interface.
#75774 Only one OU (organizational unit) is showing for imported code signing certificates.
#84053 Log Event Actions for Change Management Flows result in event logged with Missing Event Translator Event ID and Undefined Source.
#82486 Adding Code Signing Administrator rights in VCC fails with error on initial add.
#88412 Project signing activities page becomes unresponsive with large amount of keys.
#88357 Permitted Application does not work for the config tool on Linux.
#88126 Selecting existing HSM key does not honor environment template algorithm restrictions.
#89840 CommandLine info missing from sign request on macOS.

Web SDK known issues

ID Description
#66367 Certificates/Revoke does not operate properly when the revocation comment exceeds 250 characters.
#71890 If the certificate is self-signed, Certificates/Revoke should return HTTP 400 BadRequest.

Deprecated feature information

For an updated list of Trust Protection Foundation features that have been deprecated, or are planned to be deprecated, refer to the following knowledge base (KB) articles:

Getting Help

Use the following documents to learn more about Trust Protection Foundation:

  • Use the Installation Guide to plan, install, and configure a new Trust Protection Foundation environment, or to upgrade an existing one.
  • Use the Administration Guide to configure and operate the platform after installation, including identities, permissions, policies, and jobs.
  • Use the Web SDK Developers Guide to automate Trust Protection Foundation with the REST API.

Visit docs.paloaltonetworks.com/trust-protection-foundation for the complete Trust Protection Foundation documentation set.

Requesting Support

For technical assistance, contact Palo Alto Networks Customer Support at https://www.paloaltonetworks.com/company/contact-support.

To send comments or corrections about this documentation, email .

Corporate Headquarters:

Palo Alto Networks, Inc.
3000 Tannery Way
Santa Clara, CA 95054
https://www.paloaltonetworks.com/company/contact-support

© 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.

You have received this information in accordance with your software license agreement. You are not authorized to distribute this document, the software it describes, or any other intellectual property of Palo Alto Networks outside of your organization without written consent.