topic Re: Urgent action required: PAN-OS certificate expiration advisory in Next-Generation Firewall Discussions

Urgent action required: PAN-OS certificate expiration advisory

kdamodaran — Tue, 14 Nov 2023 21:00:37 GMT

I recommend reviewing the customer advisory linked above in detail in order to understand the next steps and applicability. Essentially, the root and default certificate on PAN-OS will expire on December 31, 2023 - if not renewed before that date, this will result in firewalls and/or Panorama losing connectivity to our cloud services as well as between each other when data redistribution (User-ID, Tags, etc.) is configured, potentially causing an impact to network traffic.

All of our Palo Alto firewalls and Panorama running in software version - 10.2.5 , do we need to upgrade it or its already fixed.

Re: Urgent action required: PAN-OS certificate expiration advisory

JayGolf — Wed, 15 Nov 2023 00:48:39 GMT

HI @kdamodaran ,

On 10.2.5 you are good to go. On 10.2.4 or greater, the PA root certificates are included.

Re: Urgent action required: PAN-OS certificate expiration advisory

naeem82 — Wed, 15 Nov 2023 07:04:03 GMT

is this a bug ? we have some device some running on 10.2.5 and 10.2.4 . What action is required from our side inorder not to have any impact on production.

Re: Urgent action required: PAN-OS certificate expiration advisory

robertsmyth — Wed, 15 Nov 2023 11:10:46 GMT

HI there, I've received the same message when logging in to our firewall. Current version is 10.1.3. I followed the link on the firewall which brought me here but it tells me i do not have access permissions to get to see how i remedy this issue. Can someone please help with this...Ill happily renew the certificate if Palo Alto will be so kind as to let us know how it is done!

Re: Urgent action required: PAN-OS certificate expiration advisory

naeem82 — Wed, 15 Nov 2023 12:18:35 GMT

Same here . shows access denied for me too.

Re: Urgent action required: PAN-OS certificate expiration advisory

KDamodaran1 — Wed, 15 Nov 2023 17:38:05 GMT

If the firewall is running in version 10.1.3, I recommend upgrading to target version as per below snapshot.

Re: Urgent action required: PAN-OS certificate expiration advisory

KDamodaran1 — Wed, 15 Nov 2023 17:39:19 GMT

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Re: Urgent action required: PAN-OS certificate expiration advisory

jerilkcherian — Thu, 16 Nov 2023 14:53:54 GMT

getting access denied error for this url , how to fix it ? https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-default-certificate/ta-p/564672

Re: Urgent action required: PAN-OS certificate expiration advisory

KDamodaran1 — Thu, 16 Nov 2023 15:53:29 GMT

My guess would be you have a 'free' account on the Live community instead of a customer/partner account? That page is only accessible if you have a support enabled account (access to support.paloaltonetworks.com)

Re: Urgent action required: PAN-OS certificate expiration advisory

KDamodaran1 — Thu, 16 Nov 2023 15:54:01 GMT

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

回复： Urgent action required: PAN-OS certificate expiration advisory

michaelx — Mon, 20 Nov 2023 02:58:35 GMT

pan-os 9.1.11 Does the certificate expiration affect Communication between the firewall and Windows User-ID/Terminal Server Agents or firewalls?

Re: Urgent action required: PAN-OS certificate expiration advisory

GarbajeTeam — Mon, 20 Nov 2023 14:23:25 GMT

same problem here, i cant see de link because i don't have "special priviledges"

Re: Urgent action required: PAN-OS certificate expiration advisory

Raul_Zuniga — Wed, 29 Nov 2023 18:00:25 GMT

Essentially, as long as you are in one of the versions appearing in @KDamodaran1's table and install the content update 8776-8390 or later, you should be fine. Said content update pretty much carries the new certificate.

Re: Urgent action required: PAN-OS certificate expiration advisory

GarbajeTeam — Mon, 04 Dec 2023 09:04:23 GMT

Thanks