topic Re: Failed to renew device certificate in General Topics

Failed to renew device certificate

esheldon — Tue, 19 Oct 2021 23:40:53 GMT

Sorry, not sure what board to post this on, as it's my first support post. Getting an error on my Primary PaloAlto firewall: Failed to renew device certificate.Failed to send request to CSP server.Error: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to certificatetrusted.paloaltonetworks.com:443

When I log onto the firewall, it shows the device certificate is valid on the main dashboard, and when I go to Device->Certificate Management->Certificates, all certs show fine until at least March of 2022. I'm not sure what to do at this point.

Thanks in advance!

Re: Failed to renew device certificate

BPry — Wed, 20 Oct 2021 01:33:06 GMT

@esheldon,

The device certificate process checks in regularly to automatically keep the certificate up to date and to make sure it isn't revoked. The error that you are getting can be caused by a few different things actually. I would verify that your firewall is actually getting to the URL properly according to your logs and verify that a client behind the firewall can reach that URL.

Be aware that the website will give you a certificate error and will prompt you for a client certificate. As long as you can get that prompt your firewall should be able to access the website without issue. The firewall trusts the website and presents the device certificate to authenticate to the site, so as long as your device certificate is valid you should be all set.

Re: Failed to renew device certificate

TomYoung — Thu, 21 Oct 2021 05:22:09 GMT

Hi @esheldon ,

The error is referring to the certificate under Device > Setup > Management > Device Certificate. It is not listed under Certificate Management. It is used to leverage cloud services.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/certificate-management/obtain-certificates/device-certificate.html

Thanks,

Tom