From 9a8981fa82bf30ab7fba3e113a82c0046812b0b9 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Tue, 7 Jan 2025 14:57:44 -0500
Subject: [PATCH 01/24] doc updates

---
 integration-manifest.json | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/integration-manifest.json b/integration-manifest.json
index 37b11e2..d9f3387 100644
--- a/integration-manifest.json
+++ b/integration-manifest.json
@@ -6,14 +6,15 @@
   "update_catalog": true,
   "link_github": true,
   "support_level": "kf-supported",
-  "release_dir": "PaloAlto/bin/Release/netcoreapp3.1",
+  "release_dir": "PaloAlto/PaloAlto.csproj",
+  "release_dir": "PaloAlto/bin/Release",
   "description": "The Palo Alto Orchestrator remotely manages certificates on either the Palo Alto PA-VM Firewall Device or the Panorama.  If using Panorama, it will push changes to all the devices from Panorama.  It supports adding certificates with or without private keys.  Palo Alto does not support incremental certificate inventory. If you have large numbers of certificates in your environment it is recommended to limit the frequency of inventory jobs to 30 minutes or more.",
   "about": {
     "orchestrator": {
-      "UOFramework": "10.1",
-      "keyfactor_platform_version": "9.10",
+      "UOFramework": "10.4",
+      "keyfactor_platform_version": "10.4",
       "pam_support": true,
-      "keyfactor_platform_version": "9.10",
+      "keyfactor_platform_version": "10.4",
       "win": {
         "supportsCreateStore": false,
         "supportsDiscovery": false,
@@ -52,7 +53,9 @@
               "Type": "Secret",
               "DependsOn": null,
               "DefaultValue": null,
-              "Required": false
+              "Required": false,
+			  "IsPAMEligible": true,
+              "Description": "Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
             },
             {
               "Name": "ServerPassword",
@@ -60,7 +63,9 @@
               "Type": "Secret",
               "DependsOn": null,
               "DefaultValue": null,
-              "Required": false
+              "Required": false,
+			  "IsPAMEligible": true,
+              "Description": "Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
             },
             {
               "Name": "ServerUseSsl",
@@ -68,7 +73,9 @@
               "Type": "Bool",
               "DependsOn": null,
               "DefaultValue": "true",
-              "Required": true
+              "Required": true,
+			  "IsPAMEligible": false,
+              "Description": "Should be true, http is not supported."
             },
             {
               "Name": "DeviceGroup",
@@ -76,7 +83,9 @@
               "Type": "String",
               "DependsOn": null,
               "DefaultValue": null,
-              "Required": false
+              "Required": false,
+			  "IsPAMEligible": false,
+              "Description": "Device Group on Panorama that changes will be pushed to."
             },
             {
               "Name": "InventoryTrustedCerts",
@@ -84,7 +93,9 @@
               "Type": "Bool",
               "DependsOn": null,
               "DefaultValue": "false",
-              "Required": true
+              "Required": true,
+			  "IsPAMEligible": false,
+              "Description": "If false, will not inventory default trusted certs, saves time."
             },
             {
               "Name": "TemplateStack",
@@ -92,12 +103,16 @@
               "Type": "String",
               "DependsOn": null,
               "DefaultValue": null,
-              "Required": false
+              "Required": false,
+			  "IsPAMEligible": false,
+              "Description": "Template stack used for device push of certificates via Template."
             }
           ],
           "EntryParameters": [
 
           ],
+          "ClientMachineDescription": "Either the Panorama or Palo Alto Firewall URI or IP address.",
+          "StorePathDescription": "The Store Path field should be reviewed in the store path explanation section.  It varies depending on configuration.",
           "PasswordOptions": {
             "EntrySupported": false,
             "StoreRequired": false,

From 23f490da14c636d917a1062e5d89ee5dc2ab0644 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Tue, 7 Jan 2025 15:46:57 -0500
Subject: [PATCH 02/24] Upgrade .net 6 and .net 8

---
 PaloAlto/PaloAlto.csproj                       | 15 ++++++++-------
 PaloAltoTestConsole/PaloAltoTestConsole.csproj |  5 ++++-
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/PaloAlto/PaloAlto.csproj b/PaloAlto/PaloAlto.csproj
index af55d40..7ae2040 100644
--- a/PaloAlto/PaloAlto.csproj
+++ b/PaloAlto/PaloAlto.csproj
@@ -1,9 +1,10 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
-    <RootNamespace>Keyfactor.Extensions.Orchestrator.PaloAlto</RootNamespace>
+    <AppendTargetFrameworkToOutputPath>true</AppendTargetFrameworkToOutputPath>
+    <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
+    <ImplicitUsings>disable</ImplicitUsings>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
@@ -11,10 +12,10 @@
     <DebugSymbols>false</DebugSymbols>
   </PropertyGroup>
 
-  <ItemGroup>
-    <Compile Remove="Interfaces\**" />
-    <EmbeddedResource Remove="Interfaces\**" />
-    <None Remove="Interfaces\**" />
+  <ItemGroup>
+    <Compile Remove="Interfaces\**" />
+    <EmbeddedResource Remove="Interfaces\**" />
+    <None Remove="Interfaces\**" />
   </ItemGroup>
 
   <ItemGroup>
@@ -27,7 +28,7 @@
     <PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
     <PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="0.7.0" />
     <PackageReference Include="Keyfactor.PKI" Version="3.4.8" />
-    <PackageReference Include="RestSharp" Version="107.2.1" />
+    <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="System.Management.Automation" Version="7.0.5" />
   </ItemGroup>
 
diff --git a/PaloAltoTestConsole/PaloAltoTestConsole.csproj b/PaloAltoTestConsole/PaloAltoTestConsole.csproj
index 6a3f5fe..dc3077e 100644
--- a/PaloAltoTestConsole/PaloAltoTestConsole.csproj
+++ b/PaloAltoTestConsole/PaloAltoTestConsole.csproj
@@ -2,7 +2,10 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <AppendTargetFrameworkToOutputPath>true</AppendTargetFrameworkToOutputPath>
+    <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
+    <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
+    <ImplicitUsings>disable</ImplicitUsings>
   </PropertyGroup>
 
   <ItemGroup>

From a4a863869c29ae11fed32af44a9e341ae2511fdc Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Tue, 7 Jan 2025 15:57:42 -0500
Subject: [PATCH 03/24] new doc tool

---
 docsource/content.md | 227 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 227 insertions(+)
 create mode 100644 docsource/content.md

diff --git a/docsource/content.md b/docsource/content.md
new file mode 100644
index 0000000..333e2b2
--- /dev/null
+++ b/docsource/content.md
@@ -0,0 +1,227 @@
+## Release 2.2 Update on Entry Params
+**Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
+
+**Important Note** Please review the new path considerations in the store section.  It explains how the paths work for Panorama and the Firewalls.  'locahost.localdomain' will always be that constant value.
+
+## CERT STORE SETUP AND GENERAL PERMISSIONS
+<details>
+	<summary>Cert Store Type Configuration</summary>
+	
+In Keyfactor Command create a new Certificate Store Type similar to the one below:
+
+#### STORE TYPE CONFIGURATION
+SETTING TAB  |  CONFIG ELEMENT	| DESCRIPTION
+------|-----------|------------------
+Basic |Name	|Descriptive name for the Store Type.  PaloAlto can be used.
+Basic |Short Name	|The short name that identifies the registered functionality of the orchestrator. Must be PaloAlto
+Basic |Custom Capability|You can leave this unchecked and use the default.
+Basic |Job Types	|Inventory, Add, and Remove are the supported job types. 
+Basic |Needs Server	|Must be checked
+Basic |Blueprint Allowed	|Unchecked
+Basic |Requires Store Password	|Determines if a store password is required when configuring an individual store.  This must be unchecked.
+Basic |Supports Entry Password	|Determined if an individual entry within a store can have a password.  This must be unchecked.
+Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store.  Freeform
+Advanced |Supports Custom Alias	|Determines if an individual entry within a store can have a custom Alias.  This must be Required
+Advanced |Private Key Handling |Determines how the orchestrator deals with private keys.  Optional
+Advanced |PFX Password Style |Determines password style for the PFX Password. Default
+
+#### CUSTOM FIELDS FOR STORE TYPE
+NAME          |  DISPLAY NAME	| TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION
+--------------|-----------------|-------|--------------|-------------|---------|--------------
+ServerUsername|Server Username  |Secret |              |Unchecked    |No       |Palo Alto Api User Name
+ServerPassword|Server Password  |Secret |              |Unchecked    |No       |Palo Alto Api Password
+ServerUseSsl  |Use SSL          |Bool   |True          |Unchecked    |Yes       |Requires SSL Connection
+DeviceGroup   |Device Group     |String |              |Unchecked    |No        |Device Group on Panorama that changes will be pushed to.
+InventoryTrustedCerts|Inventory Trusted Certs|Bool |False|Unchecked  |No        |If false, will not inventory default trusted certs, saves time.
+TemplateStack   |Template Stack     |String |          |Unchecked    |No        |Template stack used for device push of certificates via Template.
+
+#### ENTRY PARAMETERS FOR STORE TYPE
+The entry parameters for this version have been eliminated.  It will not longer support new bindings but will just update existing bindings when the certificate is replaced.
+
+</details>
+
+<details>
+<summary>PaloAlto Certificate Store</summary>
+In Keyfactor Command, navigate to Certificate Stores from the Locations Menu.  Click the Add button to create a new Certificate Store using the settings defined below.
+
+#### STORE CONFIGURATION 
+CONFIG ELEMENT	|DESCRIPTION
+----------------|---------------
+Category	|The type of certificate store to be configured. Select category based on the display name configured above "PaloAlto".
+Container	|This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store.
+Client Machine	|The hostname of the Panorama or Firewall.  Sample is "palourl.cloudapp.azure.com".
+Store Path	| See Store Path Explanation Section Below
+Orchestrator	|This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. 
+Inventory Schedule	|The interval that the system will use to report on what certificates are currently in the store. 
+Use SSL	|This should be checked.
+User	|ApiUser Setup for either Panorama or the Firewall Device
+Password |Api Password Setup for the user above
+
+### Store Path Explanation
+**Important Note** The store path permutations are show below
+
+#### FIREWALL SHARED SYSTEM PATH
+_________________________________
+**Path Example** /config/shared
+
+**/config**:
+This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.
+
+**/shared**:
+This section specifies that the path is within the shared settings. Shared settings are common configurations that can be used across multiple virtual systems (vsys) or contexts within the firewall.
+_________________________________
+
+
+
+
+#### FIREWALL VIRTUAL SYSTEM PATH
+_________________________________
+**Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
+
+**/config**:
+This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.
+
+**/devices**:
+This part specifies that the configuration relates to devices. In the context of a single firewall, this generally refers to the firewall itself.
+
+**/entry[@name='localhost.localdomain']**:
+The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.
+
+**/vsys**:
+This section specifies that the path is within the virtual systems (vsys) section. Virtual systems allow multiple virtualized instances of firewall configurations within a single physical firewall.
+
+**/entry[@name='vsys1']**:
+The entry tag with the attribute @name='vsys1' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys1."
+_________________________________
+
+
+
+
+#### PANORAMA SHARED TEMPLATE PATH
+_________________________________
+**Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
+
+**/config**:
+This section indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.
+
+**/devices**:
+This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.
+
+**/entry[@name='localhost.localdomain']**:
+The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the device.
+
+**/template**:
+This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.
+
+**/entry[@name='CertificatesTemplate']**:
+The entry tag with the attribute @name='CertificatesTemplate' identifies a specific template by its name. In this case, it refers to a template named "CertificatesTemplate."
+
+**/config/shared**:
+This part of the path indicates that the configuration settings within this template are shared settings. Shared settings are common configurations that can be used across multiple devices or contexts within the Panorama management system.
+_________________________________
+
+
+
+
+#### PANORAMA VIRTUAL SYSTEM PATH
+__________________________________
+**Path Example**: /config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']
+
+**/config**:
+This indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.
+
+**/devices**:
+This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.
+
+**/entry**:
+This is a generic entry point under devices. However, since it does not have a @name attribute specified at this level, it applies to the broader device category.
+
+**/template**:
+This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.
+
+**/entry[@name='CertificatesTemplate']**:
+The entry tag with the attribute @name='CertificatesTemplate' identifies a specific template by its name. In this case, it refers to a template named "CertificatesTemplate."
+
+**/config/devices**:
+This part of the path specifies that the configuration settings within this template apply to devices.
+
+**/entry**:
+This again specifies a generic entry point under devices in the context of the template. This would typically be further defined by specific device attributes, but here it leads to the virtual systems (vsys) section.
+
+**/vsys**:
+This section specifies that the path is within the virtual systems (vsys) section. Virtual systems allow multiple virtualized instances of firewall configurations within a single physical firewall.
+
+**/entry[@name='vsys2']**:
+The entry tag with the attribute @name='vsys2' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys2."
+__________________________________
+
+
+
+
+#### PANORAMA LEVEL
+__________________________________
+**Path Example**: /config/panorama
+
+**/config**:
+This indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.
+
+**/panorama**:
+This section specifies that the path is within the Panorama-specific configuration settings. This part of the configuration contains settings that are specific to the Panorama management system itself, rather than the devices it manages.
+__________________________________
+
+</details>
+
+<details>
+<summary>API User Setup Permissions in Panorama or Firewall Required</summary>
+
+Tab          |  Security Items	
+--------------|--------------------------
+Xml Api       |Report,Log,Configuration,Operational Requests,Commit,Export,Import
+Rest Api      |Objects/Devices,Panorama/Scheduled Config Push,Panorama/Templates,Panorama/Template Stacks,Panorama/Device Groups,System/Configuration,Plugins/Plugins
+*** 
+
+</details>
+
+## Test Cases
+<details>
+<summary>Firewall, Panorama Template and Panorama Level</summary>
+
+Case Number|Case Name|Store Path|Enrollment Params|Expected Results|Passed|Screenshots
+-------|----------|------------------|--------------------|----------------------------|----|--------
+TC1|Firewall Enroll No Bindings|/config/shared|**Alias**:<br>www.certandchain.com<br>**Overwrite**:<br>false|Cert and Chain Installed on Firewall|True|![](images/TC1.gif)
+TC1a|Firewall Enroll Template Stack|/config/shared|**Alias**:<br>www.tc1a.com<br>**Overwrite**:<br>false|Error Stating Template Stacks Not Used for Firewall|True|![](images/TC1a.gif)
+TC2|Firewall Replace No Bindings|/config/shared|**Alias**:<br>www.certandchain.com<br>**Overwrite**:<br>true|Cert and Chain Installed on Firewall|True|![](images/TC2.gif)
+TC3|Firewall Remove Bound Certificate|/config/shared|**Alias**:<br>0.13757535891685202<br>**Overwrite**:<br>false|Cert will **not** be removed because bound|True|![](images/TC3.gif)
+TC4|Firewall Enroll Bindings|/config/shared|**Alias**:0.13757535891685202<br>**Overwrite**:<br>false|Will not replace cert since Overwrite=false|True|![](images/TC4.gif)
+TC5|Firewall Replace Bound Certificate|/config/shared|**Alias**:0.13757535891685202<br>**Overwrite**:<br>true|Will replace cert bindings get automatically updated since Overwrite=true|True|![](images/TC5.gif)
+TC6|Firewall Inventory|/config/shared|N/A|Inventory will finish and certs from shared location inventoried.|True|![](images/TC6.gif)
+TC6a|Firewall Inventory No Trusted Certs|/config/shared|N/A|Inventory will finish no Trusted Certs and certs from shared location inventoried.|True|![](images/TC6.gif)
+TC7|Firewall Inventory With Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|N/A|Will Inventory all certificates from vsys1 on firewall|True|![](images/TC7.gif)
+TC8|Firewall Enroll cert and chain to Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**:<br>www.ejbcacertandchain.com|Cert is installed along with chain.|True|![](images/TC8.gif)
+TC9|Firewall Remove unbound cert from Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|N/A|Will remove cert from test case 8 from Firewall Virtual System|True|![](images/TC9.gif)
+TC10|Firewall Remove bound cert from Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**:<br>0.8168##|Cert will not be removed because it is bound.|True|![](images/TC10.gif)
+TC11|Firewall Replace without Overwrite on Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**:<br>0.8168##<br>**Overwrite**:<br>true|User is warned Overwrite needs checked.|True|![](images/TC11.gif)
+TC12|Firewall Renew cert on Shared and Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1'] and /config/shared|**Alias**:<br>www.renewtester.com|Cert renewed on vsys and shared locations|True|![](images/TC12.gif)
+TC13|Firewall Replace bound cert on Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**:<br>0.8168##<br>**Overwrite**:<br>true|Cert will be replaced and binding updated on vsys.|True|![](images/TC13.gif)
+TC14|Panorama Template Enroll Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>www.pantemptc1.com|Certificate is enrolled to shared location for template|True|![](images/TC14.gif)
+TC14a|Panorama Invalid Template Stack|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>www.tc14a.com|Error Occurs with list of valid Template Stacks To Use|True|![](images/TC14a.gif)
+TC15|Panorama Template Replace Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>www.pantemptc1.com<br>**Overwrite**:<br>true|Certificate is replaced in shared location for template|True|![](images/TC15.gif)
+TC16|Panorama Template Remove unbound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>www.pantemptc1.com|Certificate is removed from shared location for template|True|![](images/TC16.gif)
+TC16a|Panorama Template Stack Push|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>www.tc16a.com|Certificate pushed to Template and Template Stack|True|![](images/TC16a.gif)
+TC17|Panorama Template Replace bound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>LongNameTest<br>**Overwrite**:<br>true|Certificate is replaced, binding updated in shared location for template|True|![](images/TC17.gif)
+TC18|Panorama Template Remove bound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**:<br>LongNameTest|Certificate is not removed because it is bound|True|![](images/TC18.gif)
+TC19|Panorama Template Shared Inventory|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|N/A|Certificates are inventoried from this location|True|![](images/TC19.gif)
+TC20|Panorama Template Virtual System Inventory|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|N/A|Certificates are inventoried from this template vsys location|True|![](images/TC20.gif)
+TC21|Panorama Template Virtual System Enroll Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**:<br>www.vsys2enroll.com|Certificate is enrolled to vsys2 location for template|True|![](images/TC21.gif)
+TC21a|Panorama Level Inventory No Trusted Certs|/config/panorama|N/A|Certificates are inventoried from this location No Trusted Certs|True|![](images/TC21a.gif)
+TC22|Panorama Template Virtual System Replace unbound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**:<br>www.vsys2enroll.com|Certificate is replaced in vsys2 location for template|True|![](images/TC22.gif)
+TC23|Panorama Template Virtual System Remove unbound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**:<br>www.vsys2enroll.com|Certificate is removed in vsys2 location for template|True|![](images/TC23.gif)
+TC24|Panorama Template Virtual System Renew bound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**:<br>www.vsys2enroll.com|Certificate is renewed, binding updated in vsys2 location for template|True|![](images/TC24.gif)
+TC25|Panorama Level Inventory|/config/panorama|N/A|Certificates are inventoried from this location|True|![](images/TC25.gif)
+TC26|Panorama Level Enroll Cert and Chain|/config/panorama|**Alias**:<br>www.panlevelcertandchain.com|Panorama Level Install Cert and Chain|True|![](images/TC26.gif)
+TC27|Panorama Level Enroll Cert overwrite warning|/config/panorama|**Alias**:<br>www.panlevelcertandchain.com<br>**Overwrite**:<br>false|Cert is not installed warned Overwrite is needed|True|![](images/TC27.gif)
+TC28|Panorama Level Replace Cert|/config/panorama|**Alias**:<br>www.panlevelcertandchain.com<br>**Overwrite**:<br>true|Cert is replaced because Overwrite was used|True|![](images/TC28.gif)
+TC29|Panorama Level Remove  unbound Cert|/config/panorama|N/A|Cert is removed because not bound|True|![](images/TC28.gif)
+TC30|Panorama Level Replace bound Cert|/config/panorama|**Alias**:<br>PanoramaNoPK<br>**Overwrite**:<br>true|Cert is replaced, binding updated|True|![](images/TC30.gif)
+TC31|Firewall previous version cert store settings|/config/shared|**Alias**:<br>www.extraparams.com<br>**Overwrite**:<br>false|Cert is still installed because it ignores extra params|True|![](images/TC31.gif)
+</details>

From e55b7f84b073e1cbdab8cbde2c2aa9bb5b52fae7 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Tue, 7 Jan 2025 15:59:09 -0500
Subject: [PATCH 04/24] new doc tool

---
 ...r-bootstrap-workflow.yml => keyfactor-starter-workflow.yml} | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 rename .github/workflows/{keyfactor-bootstrap-workflow.yml => keyfactor-starter-workflow.yml} (80%)

diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml
similarity index 80%
rename from .github/workflows/keyfactor-bootstrap-workflow.yml
rename to .github/workflows/keyfactor-starter-workflow.yml
index 6d8de53..a4649f2 100644
--- a/.github/workflows/keyfactor-bootstrap-workflow.yml
+++ b/.github/workflows/keyfactor-starter-workflow.yml
@@ -11,9 +11,10 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@v2
+    uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2
     secrets:
       token: ${{ secrets.V2BUILDTOKEN}}
       APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
       gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
       gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
+      scan_token: ${{ secrets.SAST_TOKEN }}

From 0593d47f4a2a829a96b564c24c29213b4cffc82f Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 09:39:37 -0500
Subject: [PATCH 05/24] new doc tool

---
 integration-manifest.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/integration-manifest.json b/integration-manifest.json
index d9f3387..6a7ff6f 100644
--- a/integration-manifest.json
+++ b/integration-manifest.json
@@ -54,7 +54,7 @@
               "DependsOn": null,
               "DefaultValue": null,
               "Required": false,
-			  "IsPAMEligible": true,
+              "IsPAMEligible": true,
               "Description": "Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
             },
             {
@@ -64,7 +64,7 @@
               "DependsOn": null,
               "DefaultValue": null,
               "Required": false,
-			  "IsPAMEligible": true,
+              "IsPAMEligible": true,
               "Description": "Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
             },
             {
@@ -74,7 +74,7 @@
               "DependsOn": null,
               "DefaultValue": "true",
               "Required": true,
-			  "IsPAMEligible": false,
+              "IsPAMEligible": false,
               "Description": "Should be true, http is not supported."
             },
             {
@@ -84,7 +84,7 @@
               "DependsOn": null,
               "DefaultValue": null,
               "Required": false,
-			  "IsPAMEligible": false,
+              "IsPAMEligible": false,
               "Description": "Device Group on Panorama that changes will be pushed to."
             },
             {
@@ -94,7 +94,7 @@
               "DependsOn": null,
               "DefaultValue": "false",
               "Required": true,
-			  "IsPAMEligible": false,
+              "IsPAMEligible": false,
               "Description": "If false, will not inventory default trusted certs, saves time."
             },
             {
@@ -104,7 +104,7 @@
               "DependsOn": null,
               "DefaultValue": null,
               "Required": false,
-			  "IsPAMEligible": false,
+              "IsPAMEligible": false,
               "Description": "Template stack used for device push of certificates via Template."
             }
           ],

From 224e2d2899268fc24e75517dce73d92042dab582 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 09:42:28 -0500
Subject: [PATCH 06/24] new doc tool

---
 integration-manifest.json | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/integration-manifest.json b/integration-manifest.json
index 6a7ff6f..9608a89 100644
--- a/integration-manifest.json
+++ b/integration-manifest.json
@@ -51,8 +51,8 @@
               "Name": "ServerUsername",
               "DisplayName": "Server Username",
               "Type": "Secret",
-              "DependsOn": null,
-              "DefaultValue": null,
+              "DependsOn": "",
+              "DefaultValue": "",
               "Required": false,
               "IsPAMEligible": true,
               "Description": "Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
@@ -61,8 +61,8 @@
               "Name": "ServerPassword",
               "DisplayName": "Server Password",
               "Type": "Secret",
-              "DependsOn": null,
-              "DefaultValue": null,
+              "DependsOn": "",
+              "DefaultValue": "",
               "Required": false,
               "IsPAMEligible": true,
               "Description": "Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration)."
@@ -71,7 +71,7 @@
               "Name": "ServerUseSsl",
               "DisplayName": "Use SSL",
               "Type": "Bool",
-              "DependsOn": null,
+              "DependsOn": "",
               "DefaultValue": "true",
               "Required": true,
               "IsPAMEligible": false,
@@ -81,8 +81,8 @@
               "Name": "DeviceGroup",
               "DisplayName": "Device Group",
               "Type": "String",
-              "DependsOn": null,
-              "DefaultValue": null,
+              "DependsOn": "",
+              "DefaultValue": "",
               "Required": false,
               "IsPAMEligible": false,
               "Description": "Device Group on Panorama that changes will be pushed to."
@@ -91,7 +91,7 @@
               "Name": "InventoryTrustedCerts",
               "DisplayName": "Inventory Trusted Certs",
               "Type": "Bool",
-              "DependsOn": null,
+              "DependsOn": "",
               "DefaultValue": "false",
               "Required": true,
               "IsPAMEligible": false,
@@ -101,8 +101,8 @@
               "Name": "TemplateStack",
               "DisplayName": "Template Stack",
               "Type": "String",
-              "DependsOn": null,
-              "DefaultValue": null,
+              "DependsOn": "",
+              "DefaultValue": "",
               "Required": false,
               "IsPAMEligible": false,
               "Description": "Template stack used for device push of certificates via Template."

From ef1c300297c054c06e5fd5ff3158e4af8e0ebe3d Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 14:43:32 +0000
Subject: [PATCH 07/24] Update generated docs

---
 README.md             | 237 ++++++++++++++++++++++++++++++------------
 docsource/content.md  |  19 ++--
 docsource/paloalto.md |  20 ++++
 3 files changed, 194 insertions(+), 82 deletions(-)
 create mode 100644 docsource/paloalto.md

diff --git a/README.md b/README.md
index 3e0e88c..901a58f 100644
--- a/README.md
+++ b/README.md
@@ -1,100 +1,206 @@
+<h1 align="center" style="border-bottom: none">
+    Palo Alto Universal Orchestrator Extension
+</h1>
+
+<p align="center">
+  <!-- Badges -->
+<img src="https://img.shields.io/badge/integration_status-production-3D1973?style=flat-square" alt="Integration Status: production" />
+<a href="https://github.com/Keyfactor/paloalto-firewall-orchestrator/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/paloalto-firewall-orchestrator?style=flat-square" alt="Release" /></a>
+<img src="https://img.shields.io/github/issues/Keyfactor/paloalto-firewall-orchestrator?style=flat-square" alt="Issues" />
+<img src="https://img.shields.io/github/downloads/Keyfactor/paloalto-firewall-orchestrator/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" />
+</p>
 
-# Palo Alto Orchestrator
+<p align="center">
+  <!-- TOC -->
+  <a href="#support">
+    <b>Support</b>
+  </a>
+  ·
+  <a href="#installation">
+    <b>Installation</b>
+  </a>
+  ·
+  <a href="#license">
+    <b>License</b>
+  </a>
+  ·
+  <a href="https://github.com/orgs/Keyfactor/repositories?q=orchestrator">
+    <b>Related Integrations</b>
+  </a>
+</p>
 
-The Palo Alto Orchestrator remotely manages certificates on either the Palo Alto PA-VM Firewall Device or the Panorama.  If using Panorama, it will push changes to all the devices from Panorama.  It supports adding certificates with or without private keys.  Palo Alto does not support incremental certificate inventory. If you have large numbers of certificates in your environment it is recommended to limit the frequency of inventory jobs to 30 minutes or more.
+## Overview
 
-#### Integration status: Production - Ready for use in production environments.
+TODO Overview is a required section
 
-## About the Keyfactor Universal Orchestrator Extension
 
-This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” &mdash; collections of certificates and roots of trust that are found within and used by various applications.
 
-The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme.
+### PaloAlto
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
 
-The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator.
 
-## Support for Palo Alto Orchestrator
+TODO Overview is a required section
 
-Palo Alto Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com
+## Compatibility
 
-###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
+This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later.
 
----
+## Support
+The Palo Alto Universal Orchestrator extension is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com. 
+ 
+> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
 
+## Requirements & Prerequisites
 
----
+Before installing the Palo Alto Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.
 
 
+### PaloAlto Requirements
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
 
-## Keyfactor Version Supported
 
-The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.1
-## Platform Specific Notes
+TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
 
-The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running.
-| Operation | Win | Linux |
-|-----|-----|------|
-|Supports Management Add|&check; |  |
-|Supports Management Remove|&check; |  |
-|Supports Create Store|  |  |
-|Supports Discovery|  |  |
-|Supports Reenrollment|  |  |
-|Supports Inventory|&check; |  |
 
 
-## PAM Integration
 
-This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself.  This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider.
+## Create the PaloAlto Certificate Store Type
 
-The secrets that this orchestrator extension supports for use with a PAM Provider are:
+To use the Palo Alto Universal Orchestrator extension, you **must** create the PaloAlto Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.
 
-|Name|Description|
-|----|-----------|
-|ServerPassword|Key obtained from Palo Alto API to authenticate the server hosting the store|
 
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
 
-It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal.
 
-If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values.
+* **Create PaloAlto using kfutil**:
 
-<details><summary>General PAM Provider Configuration</summary>
-<p>
+    ```shell
+    # PaloAlto
+    kfutil store-types create PaloAlto
+    ```
 
+* **Create PaloAlto manually in the Command UI**:
+    <details><summary>Create PaloAlto manually in the Command UI</summary>
 
+    Create a store type called `PaloAlto` with the attributes in the tables below:
 
-### Example PAM Provider Setup
+    #### Basic Tab
+    | Attribute | Value | Description |
+    | --------- | ----- | ----- |
+    | Name | PaloAlto | Display name for the store type (may be customized) |
+    | Short Name | PaloAlto | Short display name for the store type |
+    | Capability | PaloAlto | Store type name orchestrator will register with. Check the box to allow entry of value |
+    | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add |
+    | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove |
+    | Supports Discovery | 🔲 Unchecked |  Indicates that the Store Type supports Discovery |
+    | Supports Reenrollment | 🔲 Unchecked |  Indicates that the Store Type supports Reenrollment |
+    | Supports Create | 🔲 Unchecked |  Indicates that the Store Type supports store creation |
+    | Needs Server | ✅ Checked | Determines if a target server name is required when creating store |
+    | Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint |
+    | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell |
+    | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
+    | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. |
 
-To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator.
+    The Basic tab should look like this:
 
-Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here:
+    ![PaloAlto Basic Tab](docsource/images/PaloAlto-basic-store-type-dialog.png)
 
-~~~ json
-  "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": {
-    "Host": "http://127.0.0.1:8200",
-    "Path": "v1/secret/data",
-    "Token": "xxxxxx"
-  }
-~~~
+    #### Advanced Tab
+    | Attribute | Value | Description |
+    | --------- | ----- | ----- |
+    | Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
+    | Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. |
+    | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
 
-After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions.
+    The Advanced tab should look like this:
 
-### Use the PAM Provider
-With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object.
+    ![PaloAlto Advanced Tab](docsource/images/PaloAlto-advanced-store-type-dialog.png)
 
-To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information:
+    #### Custom Fields Tab
+    Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
 
-~~~ json
-{"Secret":"my-kv-secret","Key":"myServerPassword"}
-~~~
+    | Name | Display Name | Description | Type | Default Value/Options | Required |
+    | ---- | ------------ | ---- | --------------------- | -------- | ----------- |
+    | ServerUsername | Server Username | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | Secret |  | 🔲 Unchecked |
+    | ServerPassword | Server Password | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | Secret |  | 🔲 Unchecked |
+    | ServerUseSsl | Use SSL | Should be true, http is not supported. | Bool | true | ✅ Checked |
+    | DeviceGroup | Device Group | Device Group on Panorama that changes will be pushed to. | String |  | 🔲 Unchecked |
+    | InventoryTrustedCerts | Inventory Trusted Certs | If false, will not inventory default trusted certs, saves time. | Bool | false | ✅ Checked |
+    | TemplateStack | Template Stack | Template stack used for device push of certificates via Template. | String |  | 🔲 Unchecked |
+
+    The Custom Fields tab should look like this:
+
+    ![PaloAlto Custom Fields Tab](docsource/images/PaloAlto-custom-fields-store-type-dialog.png)
+
+
+
+    </details>
+
+## Installation
+
+1. **Download the latest Palo Alto Universal Orchestrator extension from GitHub.** 
+
+    Navigate to the [Palo Alto Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/paloalto-firewall-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive.
+    | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `paloalto-firewall-orchestrator` .NET version to download |
+    | --------- | ----------- | ----------- | ----------- |
+    | Older than `11.0.0` | | | `net6.0` |
+    | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | 
+    | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` | 
+    | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | 
+    | `11.6` _and_ newer | `net8.0` | | `net8.0` |
+
+    Unzip the archive containing extension assemblies to a known location.
+
+    > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`.
+
+2. **Locate the Universal Orchestrator extensions directory.**
+
+    * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions`
+    * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions`
+    
+3. **Create a new directory for the Palo Alto Universal Orchestrator extension inside the extensions directory.**
+        
+    Create a new directory called `paloalto-firewall-orchestrator`.
+    > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory.
+
+4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `paloalto-firewall-orchestrator` directory.**
+
+5. **Restart the Universal Orchestrator service.**
+
+    Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm).
+
+
+6. **(optional) PAM Integration** 
+
+    The Palo Alto Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider.
+
+    To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension, and follow the associated instructions to install it on the Universal Orchestrator (remote).
+
+
+> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions).
 
-This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field.
-</p>
-</details> 
 
 
+## Defining Certificate Stores
 
 
----
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+
+
+> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
+
+
+## Discovering Certificate Stores with the Discovery Job
+
+### PaloAlto Discovery Job
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+
+TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
 
 
 ## Release 2.2 Update on Entry Params
@@ -143,7 +249,7 @@ The entry parameters for this version have been eliminated.  It will not longer
 <summary>PaloAlto Certificate Store</summary>
 In Keyfactor Command, navigate to Certificate Stores from the Locations Menu.  Click the Add button to create a new Certificate Store using the settings defined below.
 
-#### STORE CONFIGURATION 
+#### STORE CONFIGURATION
 CONFIG ELEMENT	|DESCRIPTION
 ----------------|---------------
 Category	|The type of certificate store to be configured. Select category based on the display name configured above "PaloAlto".
@@ -170,9 +276,6 @@ This indicates that the path is within the configuration section of the firewall
 This section specifies that the path is within the shared settings. Shared settings are common configurations that can be used across multiple virtual systems (vsys) or contexts within the firewall.
 _________________________________
 
-
-
-
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
@@ -193,9 +296,6 @@ This section specifies that the path is within the virtual systems (vsys) sectio
 The entry tag with the attribute @name='vsys1' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys1."
 _________________________________
 
-
-
-
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
@@ -219,9 +319,6 @@ The entry tag with the attribute @name='CertificatesTemplate' identifies a speci
 This part of the path indicates that the configuration settings within this template are shared settings. Shared settings are common configurations that can be used across multiple devices or contexts within the Panorama management system.
 _________________________________
 
-
-
-
 #### PANORAMA VIRTUAL SYSTEM PATH
 __________________________________
 **Path Example**: /config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']
@@ -254,9 +351,6 @@ This section specifies that the path is within the virtual systems (vsys) sectio
 The entry tag with the attribute @name='vsys2' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys2."
 __________________________________
 
-
-
-
 #### PANORAMA LEVEL
 __________________________________
 **Path Example**: /config/panorama
@@ -325,6 +419,11 @@ TC30|Panorama Level Replace bound Cert|/config/panorama|**Alias**:<br>PanoramaNo
 TC31|Firewall previous version cert store settings|/config/shared|**Alias**:<br>www.extraparams.com<br>**Overwrite**:<br>false|Cert is still installed because it ignores extra params|True|![](images/TC31.gif)
 </details>
 
-When creating cert store type manually, that store property names and entry parameter names are case sensitive
 
+## License
+
+Apache License 2.0, see [LICENSE](LICENSE).
+
+## Related Integrations
 
+See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator).
\ No newline at end of file
diff --git a/docsource/content.md b/docsource/content.md
index 333e2b2..22d1d8c 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -44,7 +44,7 @@ The entry parameters for this version have been eliminated.  It will not longer
 <summary>PaloAlto Certificate Store</summary>
 In Keyfactor Command, navigate to Certificate Stores from the Locations Menu.  Click the Add button to create a new Certificate Store using the settings defined below.
 
-#### STORE CONFIGURATION 
+#### STORE CONFIGURATION
 CONFIG ELEMENT	|DESCRIPTION
 ----------------|---------------
 Category	|The type of certificate store to be configured. Select category based on the display name configured above "PaloAlto".
@@ -71,9 +71,6 @@ This indicates that the path is within the configuration section of the firewall
 This section specifies that the path is within the shared settings. Shared settings are common configurations that can be used across multiple virtual systems (vsys) or contexts within the firewall.
 _________________________________
 
-
-
-
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
@@ -94,9 +91,6 @@ This section specifies that the path is within the virtual systems (vsys) sectio
 The entry tag with the attribute @name='vsys1' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys1."
 _________________________________
 
-
-
-
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
@@ -120,9 +114,6 @@ The entry tag with the attribute @name='CertificatesTemplate' identifies a speci
 This part of the path indicates that the configuration settings within this template are shared settings. Shared settings are common configurations that can be used across multiple devices or contexts within the Panorama management system.
 _________________________________
 
-
-
-
 #### PANORAMA VIRTUAL SYSTEM PATH
 __________________________________
 **Path Example**: /config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']
@@ -155,9 +146,6 @@ This section specifies that the path is within the virtual systems (vsys) sectio
 The entry tag with the attribute @name='vsys2' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys2."
 __________________________________
 
-
-
-
 #### PANORAMA LEVEL
 __________________________________
 **Path Example**: /config/panorama
@@ -225,3 +213,8 @@ TC29|Panorama Level Remove  unbound Cert|/config/panorama|N/A|Cert is removed be
 TC30|Panorama Level Replace bound Cert|/config/panorama|**Alias**:<br>PanoramaNoPK<br>**Overwrite**:<br>true|Cert is replaced, binding updated|True|![](images/TC30.gif)
 TC31|Firewall previous version cert store settings|/config/shared|**Alias**:<br>www.extraparams.com<br>**Overwrite**:<br>false|Cert is still installed because it ignores extra params|True|![](images/TC31.gif)
 </details>
+
+## Overview
+
+TODO Overview is a required section
+
diff --git a/docsource/paloalto.md b/docsource/paloalto.md
new file mode 100644
index 0000000..d53d056
--- /dev/null
+++ b/docsource/paloalto.md
@@ -0,0 +1,20 @@
+## Overview
+
+TODO Overview is a required section
+
+## Requirements
+
+TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+## Discovery Job Configuration
+
+TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+## Certificate Store Configuration
+
+TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+
+## Global Store Type Section
+
+TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
+

From bbe2ffcfedc69c11be93b7105ee5b194b7945422 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 09:57:28 -0500
Subject: [PATCH 08/24] new doc tool

---
 integration-manifest.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integration-manifest.json b/integration-manifest.json
index 9608a89..2e7aeb9 100644
--- a/integration-manifest.json
+++ b/integration-manifest.json
@@ -6,7 +6,7 @@
   "update_catalog": true,
   "link_github": true,
   "support_level": "kf-supported",
-  "release_dir": "PaloAlto/PaloAlto.csproj",
+  "release_project": "PaloAlto/PaloAlto.csproj",
   "release_dir": "PaloAlto/bin/Release",
   "description": "The Palo Alto Orchestrator remotely manages certificates on either the Palo Alto PA-VM Firewall Device or the Panorama.  If using Panorama, it will push changes to all the devices from Panorama.  It supports adding certificates with or without private keys.  Palo Alto does not support incremental certificate inventory. If you have large numbers of certificates in your environment it is recommended to limit the frequency of inventory jobs to 30 minutes or more.",
   "about": {

From d3fa0acd0a817f4112991b3375be2c7a6387002b Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:06:09 -0500
Subject: [PATCH 09/24] new doc tool

---
 docsource/content.md             | 53 +-------------------------------
 readme-src/readme-pam-support.md |  4 ---
 2 files changed, 1 insertion(+), 56 deletions(-)
 delete mode 100644 readme-src/readme-pam-support.md

diff --git a/docsource/content.md b/docsource/content.md
index 22d1d8c..d906703 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -3,60 +3,9 @@
 
 **Important Note** Please review the new path considerations in the store section.  It explains how the paths work for Panorama and the Firewalls.  'locahost.localdomain' will always be that constant value.
 
-## CERT STORE SETUP AND GENERAL PERMISSIONS
-<details>
-	<summary>Cert Store Type Configuration</summary>
-	
-In Keyfactor Command create a new Certificate Store Type similar to the one below:
-
-#### STORE TYPE CONFIGURATION
-SETTING TAB  |  CONFIG ELEMENT	| DESCRIPTION
-------|-----------|------------------
-Basic |Name	|Descriptive name for the Store Type.  PaloAlto can be used.
-Basic |Short Name	|The short name that identifies the registered functionality of the orchestrator. Must be PaloAlto
-Basic |Custom Capability|You can leave this unchecked and use the default.
-Basic |Job Types	|Inventory, Add, and Remove are the supported job types. 
-Basic |Needs Server	|Must be checked
-Basic |Blueprint Allowed	|Unchecked
-Basic |Requires Store Password	|Determines if a store password is required when configuring an individual store.  This must be unchecked.
-Basic |Supports Entry Password	|Determined if an individual entry within a store can have a password.  This must be unchecked.
-Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store.  Freeform
-Advanced |Supports Custom Alias	|Determines if an individual entry within a store can have a custom Alias.  This must be Required
-Advanced |Private Key Handling |Determines how the orchestrator deals with private keys.  Optional
-Advanced |PFX Password Style |Determines password style for the PFX Password. Default
-
-#### CUSTOM FIELDS FOR STORE TYPE
-NAME          |  DISPLAY NAME	| TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION
---------------|-----------------|-------|--------------|-------------|---------|--------------
-ServerUsername|Server Username  |Secret |              |Unchecked    |No       |Palo Alto Api User Name
-ServerPassword|Server Password  |Secret |              |Unchecked    |No       |Palo Alto Api Password
-ServerUseSsl  |Use SSL          |Bool   |True          |Unchecked    |Yes       |Requires SSL Connection
-DeviceGroup   |Device Group     |String |              |Unchecked    |No        |Device Group on Panorama that changes will be pushed to.
-InventoryTrustedCerts|Inventory Trusted Certs|Bool |False|Unchecked  |No        |If false, will not inventory default trusted certs, saves time.
-TemplateStack   |Template Stack     |String |          |Unchecked    |No        |Template stack used for device push of certificates via Template.
-
-#### ENTRY PARAMETERS FOR STORE TYPE
-The entry parameters for this version have been eliminated.  It will not longer support new bindings but will just update existing bindings when the certificate is replaced.
-
-</details>
-
+## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
 <summary>PaloAlto Certificate Store</summary>
-In Keyfactor Command, navigate to Certificate Stores from the Locations Menu.  Click the Add button to create a new Certificate Store using the settings defined below.
-
-#### STORE CONFIGURATION
-CONFIG ELEMENT	|DESCRIPTION
-----------------|---------------
-Category	|The type of certificate store to be configured. Select category based on the display name configured above "PaloAlto".
-Container	|This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store.
-Client Machine	|The hostname of the Panorama or Firewall.  Sample is "palourl.cloudapp.azure.com".
-Store Path	| See Store Path Explanation Section Below
-Orchestrator	|This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. 
-Inventory Schedule	|The interval that the system will use to report on what certificates are currently in the store. 
-Use SSL	|This should be checked.
-User	|ApiUser Setup for either Panorama or the Firewall Device
-Password |Api Password Setup for the user above
-
 ### Store Path Explanation
 **Important Note** The store path permutations are show below
 
diff --git a/readme-src/readme-pam-support.md b/readme-src/readme-pam-support.md
deleted file mode 100644
index d684d56..0000000
--- a/readme-src/readme-pam-support.md
+++ /dev/null
@@ -1,4 +0,0 @@
-|Name|Description|
-|----|-----------|
-|ServerPassword|Key obtained from Palo Alto API to authenticate the server hosting the store|
-

From d89804cf41aa342961f9e16fe91a37f6ffe537b5 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:07:17 +0000
Subject: [PATCH 10/24] Update generated docs

---
 README.md | 53 +----------------------------------------------------
 1 file changed, 1 insertion(+), 52 deletions(-)

diff --git a/README.md b/README.md
index 901a58f..c6ee081 100644
--- a/README.md
+++ b/README.md
@@ -208,60 +208,9 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 
 **Important Note** Please review the new path considerations in the store section.  It explains how the paths work for Panorama and the Firewalls.  'locahost.localdomain' will always be that constant value.
 
-## CERT STORE SETUP AND GENERAL PERMISSIONS
-<details>
-	<summary>Cert Store Type Configuration</summary>
-	
-In Keyfactor Command create a new Certificate Store Type similar to the one below:
-
-#### STORE TYPE CONFIGURATION
-SETTING TAB  |  CONFIG ELEMENT	| DESCRIPTION
-------|-----------|------------------
-Basic |Name	|Descriptive name for the Store Type.  PaloAlto can be used.
-Basic |Short Name	|The short name that identifies the registered functionality of the orchestrator. Must be PaloAlto
-Basic |Custom Capability|You can leave this unchecked and use the default.
-Basic |Job Types	|Inventory, Add, and Remove are the supported job types. 
-Basic |Needs Server	|Must be checked
-Basic |Blueprint Allowed	|Unchecked
-Basic |Requires Store Password	|Determines if a store password is required when configuring an individual store.  This must be unchecked.
-Basic |Supports Entry Password	|Determined if an individual entry within a store can have a password.  This must be unchecked.
-Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store.  Freeform
-Advanced |Supports Custom Alias	|Determines if an individual entry within a store can have a custom Alias.  This must be Required
-Advanced |Private Key Handling |Determines how the orchestrator deals with private keys.  Optional
-Advanced |PFX Password Style |Determines password style for the PFX Password. Default
-
-#### CUSTOM FIELDS FOR STORE TYPE
-NAME          |  DISPLAY NAME	| TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION
---------------|-----------------|-------|--------------|-------------|---------|--------------
-ServerUsername|Server Username  |Secret |              |Unchecked    |No       |Palo Alto Api User Name
-ServerPassword|Server Password  |Secret |              |Unchecked    |No       |Palo Alto Api Password
-ServerUseSsl  |Use SSL          |Bool   |True          |Unchecked    |Yes       |Requires SSL Connection
-DeviceGroup   |Device Group     |String |              |Unchecked    |No        |Device Group on Panorama that changes will be pushed to.
-InventoryTrustedCerts|Inventory Trusted Certs|Bool |False|Unchecked  |No        |If false, will not inventory default trusted certs, saves time.
-TemplateStack   |Template Stack     |String |          |Unchecked    |No        |Template stack used for device push of certificates via Template.
-
-#### ENTRY PARAMETERS FOR STORE TYPE
-The entry parameters for this version have been eliminated.  It will not longer support new bindings but will just update existing bindings when the certificate is replaced.
-
-</details>
-
+## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
 <summary>PaloAlto Certificate Store</summary>
-In Keyfactor Command, navigate to Certificate Stores from the Locations Menu.  Click the Add button to create a new Certificate Store using the settings defined below.
-
-#### STORE CONFIGURATION
-CONFIG ELEMENT	|DESCRIPTION
-----------------|---------------
-Category	|The type of certificate store to be configured. Select category based on the display name configured above "PaloAlto".
-Container	|This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store.
-Client Machine	|The hostname of the Panorama or Firewall.  Sample is "palourl.cloudapp.azure.com".
-Store Path	| See Store Path Explanation Section Below
-Orchestrator	|This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. 
-Inventory Schedule	|The interval that the system will use to report on what certificates are currently in the store. 
-Use SSL	|This should be checked.
-User	|ApiUser Setup for either Panorama or the Firewall Device
-Password |Api Password Setup for the user above
-
 ### Store Path Explanation
 **Important Note** The store path permutations are show below
 

From dc5d6276790011f737fe9856771de5a7efce0ed8 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:13:24 -0500
Subject: [PATCH 11/24] new doc tool

---
 docsource/content.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docsource/content.md b/docsource/content.md
index d906703..3039b05 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -5,7 +5,8 @@
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
-<summary>PaloAlto Certificate Store</summary>
+<summary>Store Path and API Security</summary>
+
 ### Store Path Explanation
 **Important Note** The store path permutations are show below
 

From 171f924dd1ed4e51aa7ee5358926c8bb7c480fa1 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:14:38 +0000
Subject: [PATCH 12/24] Update generated docs

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c6ee081..bda5585 100644
--- a/README.md
+++ b/README.md
@@ -210,7 +210,8 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
-<summary>PaloAlto Certificate Store</summary>
+<summary>Store Path and API Security</summary>
+
 ### Store Path Explanation
 **Important Note** The store path permutations are show below
 

From 05c149ee63b6c14d10a0eb27e804b08cb3e578e2 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:18:23 -0500
Subject: [PATCH 13/24] new doc tool

---
 docsource/content.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docsource/content.md b/docsource/content.md
index 3039b05..f24cfa0 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -5,7 +5,7 @@
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
-<summary>Store Path and API Security</summary>
+<summary>Store Path Permutations</summary>
 
 ### Store Path Explanation
 **Important Note** The store path permutations are show below

From e60e057e3515045b6cba209044ebfb8e8b2e6ced Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:19:37 +0000
Subject: [PATCH 14/24] Update generated docs

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index bda5585..cbe3ec9 100644
--- a/README.md
+++ b/README.md
@@ -210,7 +210,7 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>
-<summary>Store Path and API Security</summary>
+<summary>Store Path Permutations</summary>
 
 ### Store Path Explanation
 **Important Note** The store path permutations are show below

From e0a473293f50164786048716059feeaa4fc7cfad Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:21:32 -0500
Subject: [PATCH 15/24] new doc tool

---
 docsource/content.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docsource/content.md b/docsource/content.md
index f24cfa0..8c4eec7 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -1,7 +1,7 @@
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the store section.  It explains how the paths work for Panorama and the Firewalls.  'locahost.localdomain' will always be that constant value.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  =='locahost.localdomain'== will always be that ==constant value==.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From ff0ec6390fc2e97d71ed8f93cb46c8c470413ad9 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:22:35 +0000
Subject: [PATCH 16/24] Update generated docs

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cbe3ec9..8da16ee 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the store section.  It explains how the paths work for Panorama and the Firewalls.  'locahost.localdomain' will always be that constant value.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  =='locahost.localdomain'== will always be that ==constant value==.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From 0977a7d02ab7d4b86aedad79a9e39d90c0989b44 Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:28:05 -0500
Subject: [PATCH 17/24] new doc tool

---
 docsource/content.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docsource/content.md b/docsource/content.md
index 8c4eec7..6da7cd9 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -1,7 +1,7 @@
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  =='locahost.localdomain'== will always be that ==constant value==.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that *anything else!*.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From 4cc5e62aa282bd9abfa645ad0d1fd63ec27b544b Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:29:14 +0000
Subject: [PATCH 18/24] Update generated docs

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8da16ee..6959dd1 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  =='locahost.localdomain'== will always be that ==constant value==.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that *anything else!*.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From 7e4f13fdd743c98a9ba38e1ae42940049caa79ef Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:33:30 -0500
Subject: [PATCH 19/24] new doc tool

---
 docsource/content.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docsource/content.md b/docsource/content.md
index 6da7cd9..8709886 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -1,7 +1,7 @@
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that *anything else!*.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From f22bd737564254e169211243dc1fed54774ca469 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:34:30 +0000
Subject: [PATCH 20/24] Update generated docs

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6959dd1..4cfdd87 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ TODO Discovery Job Configuration is an optional section. If this section doesn't
 ## Release 2.2 Update on Entry Params
 **Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.
 
-**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that *anything else!*.
+**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 ## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
 <details>

From 703afa3a42744c9ffe1ae9aae6590c0628646b3d Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:39:53 -0500
Subject: [PATCH 21/24] new doc tool

---
 docsource/content.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docsource/content.md b/docsource/content.md
index 8709886..0a740cf 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -24,6 +24,7 @@ _________________________________
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
+**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
 This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.
@@ -32,7 +33,7 @@ This indicates that the path is within the configuration section of the firewall
 This part specifies that the configuration relates to devices. In the context of a single firewall, this generally refers to the firewall itself.
 
 **/entry[@name='localhost.localdomain']**:
-The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.
+Note `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.  The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.
 
 **/vsys**:
 This section specifies that the path is within the virtual systems (vsys) section. Virtual systems allow multiple virtualized instances of firewall configurations within a single physical firewall.
@@ -44,6 +45,7 @@ _________________________________
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
+**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
 This section indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.
@@ -52,7 +54,7 @@ This section indicates that the path is within the configuration section of the
 This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.
 
 **/entry[@name='localhost.localdomain']**:
-The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the device.
+Note `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.  The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the device.
 
 **/template**:
 This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.

From d83a469d9c10039840e41de90b003363755af437 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:40:53 +0000
Subject: [PATCH 22/24] Update generated docs

---
 README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4cfdd87..9691d6e 100644
--- a/README.md
+++ b/README.md
@@ -229,6 +229,7 @@ _________________________________
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
+**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
 This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.
@@ -237,7 +238,7 @@ This indicates that the path is within the configuration section of the firewall
 This part specifies that the configuration relates to devices. In the context of a single firewall, this generally refers to the firewall itself.
 
 **/entry[@name='localhost.localdomain']**:
-The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.
+Note `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.  The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.
 
 **/vsys**:
 This section specifies that the path is within the virtual systems (vsys) section. Virtual systems allow multiple virtualized instances of firewall configurations within a single physical firewall.
@@ -249,6 +250,7 @@ _________________________________
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
+**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
 This section indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.
@@ -257,7 +259,7 @@ This section indicates that the path is within the configuration section of the
 This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.
 
 **/entry[@name='localhost.localdomain']**:
-The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the device.
+Note `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.  The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the device.
 
 **/template**:
 This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.

From 01f6396f5d2cf5f95cbdd5aafece68db80affcdb Mon Sep 17 00:00:00 2001
From: Brian Hill <bhill@keyfactor.com>
Date: Wed, 8 Jan 2025 10:42:25 -0500
Subject: [PATCH 23/24] new doc tool

---
 docsource/content.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docsource/content.md b/docsource/content.md
index 0a740cf..0a4c8ab 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -24,6 +24,7 @@ _________________________________
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
+
 **Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
@@ -45,6 +46,7 @@ _________________________________
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
+
 **Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:

From 3f6a7f9eb240035d6da1774e692e39c04ee32085 Mon Sep 17 00:00:00 2001
From: Keyfactor <keyfactor@keyfactor.github.io>
Date: Wed, 8 Jan 2025 15:43:27 +0000
Subject: [PATCH 24/24] Update generated docs

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 9691d6e..40d94f8 100644
--- a/README.md
+++ b/README.md
@@ -229,6 +229,7 @@ _________________________________
 #### FIREWALL VIRTUAL SYSTEM PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']
+
 **Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**:
@@ -250,6 +251,7 @@ _________________________________
 #### PANORAMA SHARED TEMPLATE PATH
 _________________________________
 **Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared
+
 **Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.
 
 **/config**: