topic Re: Device Certificate Enforcement Issue Encountered in Next-Generation Firewall Discussions

Device Certificate Enforcement Issue Encountered

J.Santos708860 — Wed, 04 Feb 2026 17:17:02 GMT

Hi, I am following the instructions to apply the device certificate, but I am blocked by the following error:
“Unable to execute OTP install operations command to some firewalls. Please identify the firewalls that failed the process from Panorama and retry OTP.”

I followed the instructions provided in this link:
https://live.paloaltonetworks.com/t5/customer-advisories/update-to-additional-pan-os-certificate-expirations-and-new/ta-p/572158

My setup is as follows:

Panorama: Software version 11.1.6-h3

NGFW: Model PA-850, Software version 11.1.6-h3

The command below shows the following output:

show device-certificate status
Device Certificate Information:

Current device certificate status: Valid

Not valid before: 2025/12/26 05:26:50 CST

Not valid after: 2026/03/26 06:26:49 CDT

Last fetched timestamp: 2026/02/04 10:42:39 CST

Last fetched status: Failure

Last fetched info: Failed to fetch device certificate. OTP is not valid

Re: Device Certificate Enforcement Issue Encountered

nmbarker — Thu, 05 Feb 2026 14:55:03 GMT

I ran into something similar, the following helped me and might help you.

* Configure NTP, sync and commit the changes. OTP are time based and could cause issues if there is a time drift. If the times didn't match, try creating a new OTP and retry.

* Another option to get more info, in CLI execute the following commands.

> show system log | match cert > show system log | match otp

Hope this helps!

Re: Device Certificate Enforcement Issue Encountered

J.Santos708860 — Thu, 05 Feb 2026 15:56:44 GMT

Hi @nmbarker, NTP is already configured and pointing to pool.ntp.org. I tried running these commands, but they did not give me any output on the firewall and Panorama.

> show system log | match cert > show system log | match otp

I also see that the clock is correct when I run the show clock command.

Re: Device Certificate Enforcement Issue Encountered

nmbarker — Thu, 05 Feb 2026 16:08:57 GMT

Inside of Panorama, under Panorama > Managed Devices > Summary > Device Certificate / OTP can you see if there's a way to acknowledge the failed OTP operation?

Re: Device Certificate Enforcement Issue Encountered

J.Santos708860 — Fri, 06 Feb 2026 16:56:18 GMT

Hi @nmbarker , under the "Device Certificate" column, I only see "valid." But I still need to change it, right? From what I understand, if enforcement occurs, that valid certificate will no longer renew automatically