#!/bin/bash
PAN_MGMT=<Insert IP or FQDN> #To specify a port, use this format xx.xx.xx.xx:xxxx
FQDN=<Certificate FQDN>
API_KEY=<Insert API key>
CERT_NAME=<Name of certificate as seen in the Palo Alto firewall interface>
GP_PORTAL_TLS_PROFILE=<Name of the ssl/tls service profile>
TEMP_PWD=$(openssl rand -hex 15)
#Requirements: openssl, pan-python, certbot

openssl pkcs12 -export -out digicert_pkcs12.pfx -inkey /etc/letsencrypt/live/$FQDN/privkey.pem -in /etc/letsencrypt/live/$FQDN/cert.pem -certfile /etc/letsencrypt/live/$FQDN/chain.pem -passout pass:$T>
curl -k --form file=@digicert_pkcs12.pfx "https://$PAN_MGMT/api/?type=import&category=certificate&certificate-name=$CERT_NAME&format=pkcs12&passphrase=$TEMP_PWD&key=$API_KEY" && echo " "
curl -k --form file=@digicert_pkcs12.pfx "https://$PAN_MGMT/api/?type=import&category=private-key&certificate-name=$CERT_NAME&format=pkcs12&passphrase=$TEMP_PWD&key=$API_KEY" && echo " "
rm digicert_pkcs12.pfx
panxapi.py -h $PAN_MGMT -K $API_KEY -S "<certificate>$CERT_NAME</certificate>" "/config/shared/ssl-tls-service-profile/entry[@name='$GP_PORTAL_TLS_PROFILE']"
panxapi.py -h $PAN_MGMT -K $API_KEY -C '' --sync