topic Re: PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome in Next-Generation Firewall Discussions

PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

ksuplicki — Mon, 12 Dec 2022 15:19:41 GMT

I just upgraded PA-820 from PAN-OS 10.2 to 11 and when I try to access the GUI in Chrome I get the following error:

ERR_SSL_KEY_USAGE_INCOMPATIBLE

I can access an SSH command line session.

Suggestions on correcting this?

Re: PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

ksuplicki — Tue, 13 Dec 2022 14:45:54 GMT

This is a certificate error. Resolved by following this:

Resolution

Option1:

If the SSL TLS profile used for management is known delete the same. This way the management access starts using the default certificate.
For example, The following command deletes the SSL TLS profile used for HTTPS access named profile-1

> configure
# delete deviceconfig system ssl-tls-service-profile
# delete shared ssl-tls-service-profile profile-1
# commit
# exit

Option2:

Since SSH access is possible, a new certificate can be created from the CLI.
Add the certificate to the SSL TLS profile
Use the newly configured certificate and SSL profile to be used for HTTPS.

Example below:

> request certificate generate ca yes certificate-name <cert name> name <IP or FQDN> algorithm RSA rsa-nbits 2048
> configure
# set shared ssl-tls-service-profile <profile name> certificate <cert name> protocol-settings min-version tls1-0 max-version tls1-2
# set deviceconfig system ssl-tls-service-profile <profile name>
# commit
# exit

Re: PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

PavelK — Sat, 07 Jan 2023 01:46:52 GMT

Thank you for great sharing @ksuplicki

only for information Palo Alto has released an official KB for this issue: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000saCQCAY

Kind Regards

Pavel

Re: PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

Dan_Morin — Fri, 01 Mar 2024 18:06:22 GMT

Official KB says it happens after upgrading to 11, but we're seeing it even with version 10!
GUI is accessible with Firefox, just not with Chrome or Edge.
Why would latest Chrome or Edge have problems with TLS 1.3 where Palo has to be told to not negotiate TLS 1.3, and why aren't the two negotiating down to the common denominator of 1.2 even if Chrome/Edge didn't support 1.3?