Panos deploy-hook to update certs in Panorama Device Template

[StuHare]

I have used acme.sh and the panos deploy hook to request and import an LE certificate into the panorama.

Unfortunately this only imports it into the panoramas certificate store and not the cert store for firewall / device template.

Is there a way to use the API/hook to deploy the cert into the device template so it can be committed to each of the managed firewalls within the panorama and added to the firewalls SSL profile?

If not is there a method where we can do this to each firewall, either by defining multiple hosts in panos.sh or perhaps by running multiple shell scripts (e.g. panos-fw1.sh & panos-fw2.sh each with the individual firewalls UN/PWD/Host details)?

[github-cli]

On Panorama this would require the device template to be able to be specified which with the current script is not possible (though I guess someone could edit the current script to create a new panorama script for this!)
As for deploying this on multiple standalone firewalls... not sure as I am trying to find out the same thing, deploy the cert with several identical (as in type) deploy-hooks, e.g. two different palos

[StuHare]

I managed to resolve this issue by referencing the template in the 'deployer ()' function.

First take a copy of the 'panos.sh' script' before you make any changes.

Define a new variable at the start of the function to set the name of the template - e.g.:

template="Default template"

Then update the content header to include the template and the new name variable under the cert and key 'if' statements, like so:

if [ "$type" = 'cert' ]; then panos_url="${panos_url}?type=import" content="--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\ncertificate" content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n$_cdomain" content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n$_panos_key" content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\npem" content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")" content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"target-tpl\"\r\n\r\n$template" fi

This worked for me, but I am connecting to the PANOS API on the Panorama and not the firewalls, although the same process should apply there too.