topic Re: Errors - ROOT CA authority untrusted / invalid in VM-Series in the Private Cloud

Errors - ROOT CA authority untrusted / invalid

vij — Wed, 21 Dec 2022 23:45:15 GMT

PA-VM Series 8, vm-mode: Microsoft Azure

sw-version: 10.1.6-h6 global-protect-client-package-version: 5.2.1

Issue:

when trying to access websites, we are getting a lot of errors saying that the ROOT CA authority is untrusted/invalid

Error details: Received fatal alert CertificateUnknown from the client. CA Issuer URL (truncated):http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA

Certificate Information,

CA- Trusted Root CA

status Valid

Re: Errors - ROOT CA authority untrusted / invalid

SARowe_NZ — Thu, 22 Dec 2022 21:23:20 GMT

Hi,

The error states this has come from the client and means that the client does not trust the issue URL. Palo has pulled out the originating CA Cert for you but the issue is most likely you are doing decryption and the client does not trust your decryption cert. This is either because:

1) it does not have the decryption cert chain installed and/or trusted

2) the browser is not using the machine trust store (e.g. firefox) and maintains its own trust store that will need the cert chain adding

We also see this when the traffic is from inside an application that does not use the machine trust store, or is doing cert pinning but you state your issue is with browsing so probably not that.

Cheers,

Shannon

Re: Errors - ROOT CA authority untrusted / invalid

vij — Thu, 22 Dec 2022 21:27:38 GMT

I will try & let me know.

Re: Errors - ROOT CA authority untrusted / invalid

SARowe_NZ — Thu, 22 Dec 2022 21:31:23 GMT

As a test, or if you completely trust this particular website, you could also exclude it from decryption; but I always prefer to resolve it properly and allow the firewall to decrypt and inspect the traffic for threats instead of just excluding decryption and blinding trusting it.

Re: Errors - ROOT CA authority untrusted / invalid

VirupakshaRajapur — Wed, 01 Nov 2023 15:44:37 GMT

Hi,

Anyone get the solution for this issue. we are getting the same issue

Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20ECC%2

We are looking for the permanent fix as solution given in below article is the workaround for which lot of manual task need to do.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chains

Re: Errors - ROOT CA authority untrusted / invalid

Raido_Rattameister — Wed, 01 Nov 2023 16:58:27 GMT

Can you give one example URL where you get CA cert error?

This usually happens if website don't include intermediate cert in the chain.

Windows download intermediate certificates automatically but Linux (and Palo) does not.

Unfortunately vast amount of website admins have no idea how certificates work and what they should include...

Re: Errors - ROOT CA authority untrusted / invalid

VirupakshaRajapur — Thu, 02 Nov 2023 10:31:10 GMT

Hi, Raido_Rattameister

Below are the some URLs for which we are getting the decryption issue.

As per the workaround https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chains it's not very practical to add intermediate certificate in firewall for each and every URL and it's time consuming as well. Not sure if there is any alternate fix for this issue.

http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt
http://crt.e2m02.amazontrust.com/e2m02.cer
http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA
http://www.microsoft.com/pki/mscorp/Microsoft%20RSA%20TLS%20CA%
http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20ECC%2
http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%2
http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt
http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
http://cacerts.geotrust.com/GeoTrustTLSRSACAG1.crt
http://cacerts.thawte.com/ThawteRSACA2018.crt
http://pki.goog/repo/certs/gts1c3.der
http://r3.i.lencr.org/
http://zerossl.crt.sectigo.com/ZeroSSLECCDomainSecureSiteCA.crt

Re: Errors - ROOT CA authority untrusted / invalid

asmaaelkandoussi — Mon, 18 Dec 2023 13:32:14 GMT

Hi ,

Any solution for that problem

Thank you

Re: Errors - ROOT CA authority untrusted / invalid

Raido_Rattameister — Mon, 18 Dec 2023 16:20:54 GMT

Problem is not on the firewall but clueless website administrators who don't follow standards.

RFC states:

“If the server is authenticated, its certificate message must provide a valid certificate chain leading to an acceptable certificate authority.”
https://datatracker.ietf.org/doc/html/rfc5246

If website does not attach intermediate in cert chain then you can either remove those sites from being tested against trusted CA check or upload those intermediate CA certs into Palo manually.