https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/certificate-management/obtain-a-certificate-from-an-external-ca#42761
three is also a chain about cisco ssl vpn