Supported integrations: devices, applications, services and features supported by Palo Alto Networks

The following table shows you which devices, applications (and related features), and services are supported by Palo Alto Networks Trust Protection Foundation. For a similar list, see System requirements for Trust Protection Foundation components.

PKIX-Aligned Policy Enforcement: Supported drivers strictly enforce standard certificate profiles and centrally defined cryptographic policies. If a target application rejects the requested algorithm, the driver returns an explicit error instead of silently downgrading the key. Refer to the following table for drivers supporting PKIX-alignment.

Drivers/Features	Interfaces	Remote Generation	Advanced Key Protect (HSM Key Generation)	Supported Algorithms	Workflow Command Injection	Extraction	Certificate Whitelisting (Trust Store)	Jump Server	Generational Management
Adaptable Application	Defined by PowerShell script. See About Venafi Adaptable Driver PowerShell scripts.			RSA, ECC, PKIX		(if Extract-PrivateKey script function is implemented)			(if Remove-Certificate script function is implemented)
Amazon Web Services (AWS)	API (REST)			RSA, ECC, PKIX
Apache	SSH CLI		(17.2) NOTE: ECC key generation is supported for SafeNet HSMs. It is not currently supported for nShield HSMs.	RSA, ECC, PKIX		(if not HSM key)			(backup file)
CAPI (IIS 7+)	WinRM	(17.2)	(17.2)	RSA, ECC, PKIX	(PowerShell)	(if private key is exportable)	(14.1)		(17.2)
Citrix NetScaler	API (REST), SSH CLI			RSA, ECC NOTE: Supported ECC curves include P-256 and P-384.		(if not FIPS private key)		(in legacy SSH mode)
F5 LTM Advanced	API (SDK, REST)			RSA, ECC, PKIX	(SSH CLI)	(if not FIPS private key)	(14.2)		(delete previous)
IBM Connect:Direct	API (Java)			RSA			(14.3)
IBM DataPower	API (REST, XML), SSH CLI			RSA		(only when using SSH method)	(20.3)
IBM GSK 6	SSH CLI			RSA			(15.2)		(backup file)
IBM GSK 7				RSA
IBM GSK 8				RSA
IIS	API (DCOM)			RSA
Imperva MX	SSH CLI (Java)			RSA
Java Keystore (JKS and JCEKS)	SSH CLI		(17.2)	RSA, ECC, PKIX		X (if not HSM key)	(14.1)		(backup file)
Microsoft Azure Key Vault	API (SDK)			RSA		(if private key is exportable)			n/a
Oracle iPlanet (NSS)	SSH CLI			RSA					(backup file)
Palo Alto Networks NGFW	API (XML-RPC)			RSA, ECC, PKIX NOTE: These algorithms are only supported for certificate discovery, and not for provisioning. Post-quantum certificates are set to Monitoring in Trust Protection Foundation.			(15.1)
Panorama	API (XML)	(not with Template Stack provisioning)		RSA, ECC NOTE: Post-quantum certificates are discovered, but they cannot be provisioned or renewed by Trust Protection Foundation.
PEM	SSH CLI			RSA, ECC, PKIX			(14.1)		(backup file)
PKCS#12	SSH CLI			RSA, ECC, PKIX			(15.1)		(backup file)
Riverbed SteelHead	SSH CLI			RSA
Tealeaf PCA	SSH CLI			RSA