topic Re: Device Certificate unable renew automatically in Next-Generation Firewall Discussions

Device Certificate unable renew automatically

Aniq_Razak — Fri, 09 Feb 2024 03:46:58 GMT

Hi All,

Previously, the firewall PAN-PA-1420 had "Failed to renew device certificate. Invalid request. Authentication failed" until the device certificate status became Expired. This triggered an alert because the firewall couldn't establish a connection with the cloud service.

However, the issue was resolved by manually renewing the device certificate using the command "request certificate fetch." and the device certificate is now valid.

According to the documentation, the firewall should automatically attempt to reinstall the device certificate 15 days before it expires. Restore an Expired Device Certificate (paloaltonetworks.com)

What caused the firewall to be unable to automatically renew the device certificate before it expired?
How often does the firewall try to renew the certificate in the 15 days before it expires?

Thank you.

Re: Device Certificate unable renew automatically

iarobertson — Fri, 09 Feb 2024 03:52:58 GMT

Hello @Aniq_Razak - there are multiple reasons this process could fail, generally related to network connectivity issues. What version of PAN-OS are you using on your PA-1420?

Re: Device Certificate unable renew automatically

Aniq_Razak — Fri, 09 Feb 2024 03:59:19 GMT

Hi @iarobertson - thank you for your response. Currently running PAN-OS 11.0.1-h2

Re: Device Certificate unable renew automatically

iarobertson — Fri, 09 Feb 2024 04:07:08 GMT

Is your connection via a proxy, or direct to the internet, @Aniq_Razak ?