Building for Next-Gen Trust Security
Next-Gen Trust Security (NGTS) delivers machine identity management inside Palo Alto Networks Strata Cloud Manager (SCM). It shares the certificate lifecycle and the connector frameworks with Certificate Manager SaaS, but identity, access, and resource ownership are handled by Strata Cloud Manager rather than by the certificate platform itself.
Most of your code carries over. Two changes require work on your side — authentication and removing any dependency on Applications. Adding NGTS Support to Your Integration walks through both, maps the certificate lifecycle building blocks onto NGTS, and includes a migration checklist.
Choose Your Build Path
| Approach | Use it to | Guide |
|---|---|---|
| CA Connector | Issue certificates from a third-party Certificate Authority | CA Connector Framework |
| Machine Connector | Deploy and configure certificates on servers, load balancers, and network devices | Machine Connector Framework |
| REST API | Automate certificate operations from any language | NGTS API Reference |
| VCert SDK | Enroll, retrieve, and revoke certificates from Go, Python, Java, or .NET | VCert |
Connectors are the build path for NGTS, as they are for Certificate Manager SaaS. The PowerShell Adaptable Framework applies only to Certificate Manager Self-Hosted — see Connectors vs. Adaptable Drivers.
Authentication
NGTS uses the OAuth 2.0 Client Credentials flow, not API keys. Machine-to-machine access uses accounts designed for non-human callers:
- Strata service accounts — for invoking NGTS APIs through the Strata API gateway.
- NGTS built-in accounts — machine accounts within NGTS, including a Custom API Integration use case that authenticates using Workload Identity Federation (WIF). WIF lets your application authenticate with short-lived tokens from a trusted Identity Provider instead of managing long-lived keys.
Request a token using the client_id and client_secret for your service account with a scope of tsg_id:XXXXXXXXXX, where XXXXXXXXXX is the Tenant Service Group ID. Attach the resulting JWT to every call:
Authorization: Bearer <token>
The API base URL differs from Certificate Manager SaaS:
https://api.strata.paloaltonetworks.com/ngts
Which account type applies depends on how your integration calls NGTS. The Palo Alto Networks team will confirm the right path with you during enablement.
Concepts That Affect Your Integration
- Tenant Service Groups (TSGs) own resources. When your integration requests or creates a certificate, it is owned by the TSG that performed the action. A caller's effective permissions are the intersection of the TSG it operates in and the role assigned to it.
- Tags replace Applications for grouping. Request a certificate by specifying an Issuing Template available to the TSG, plus a tag indicating the application it secures.
- Applications and Teams do not exist. Remove any logic that creates, references, or assigns to them.
Reference Documentation
- NGTS API Reference — full endpoint catalog with an interactive authentication walkthrough
- NGTS API on pan.dev — the Strata Cloud Manager API portal
- Next-Gen Trust Security product documentation
Getting Enabled
To build and test against NGTS, you'll be provisioned with an NGTS test environment and account access. Reach out to your Palo Alto Networks partner contact to get started, and share the best technical contacts on your side to enable.
Next Steps
- Adding NGTS Support to Your Integration — the full migration reference
- Integration Best Practices — error handling, logging, testing, and security patterns