topic Re: Install Device Certificate for LogCollector CLI in General Topics

Install Device Certificate for LogCollector CLI

omarbatis — Wed, 22 Sep 2021 09:38:13 GMT

Hello everyone,

I upgraded a Pan log collector to Software version 9.1.11 . Recently I receive the event "No valid device certificate found" . So I need to generate OTP certificate and install it . This can be done easily through GUI. However, with LogCollecor , Web UI is disabled and CLI is the only way to access the device .

Can anyone guide on how to install the OTP certificate on Pan LC through CLI ?

Re: Install Device Certificate for LogCollector CLI

PavelK — Wed, 22 Sep 2021 10:15:52 GMT

Thank you for posting question @omarbatis

I had the same issue and could not find any way to do it by CLI. I ended up opening a ticket to TAC. Unfortunately, the answer was it is not possible to provision a device certificate for log collector. Unless they came up with a new feature in future releases to do it, you will have to ignore warning about missing certificate.

Kind Regards

Pavel

Re: Install Device Certificate for LogCollector CLI

MajesticSteel — Wed, 05 Jan 2022 16:03:11 GMT

PAN-OS 9.1.11

Panorama appliances in Log Collector mode only - The following CLI command was added to disable

No valid device certificate found messages in the system log:

debug skip-cert-renewal-check-syslog yes

Re: Install Device Certificate for LogCollector CLI

PavelK — Fri, 07 Jan 2022 23:08:41 GMT

Thank you for the post @MajesticSteel and great catch!

I based my reply on experience with PAN-OS earlier than 9.1.11 and did not realized this has been fixed: PAN-157089, however I tried to issue this in M-500 as well we M-600 running 9.1.12-h3, but this command is not available. I have opened a TAC case again, but there was no update since 3 days. Did you manage to resolve this issue?

Kind Regards

Pavel

Re: Install Device Certificate for LogCollector CLI

MajesticSteel — Mon, 10 Jan 2022 13:09:29 GMT

I did not have the issue. Just happened to notice the post and a possible fix so I shared it.

Re: Install Device Certificate for LogCollector CLI

PavelK — Wed, 20 Apr 2022 12:24:04 GMT

Sorry for not getting back to you earlier. Yesterday after approximately 3 month, I got a reply from TAC. This debug command is not available for log collector, but will be added in the future release. Timeline for this is not defined yet. For now, there is no way to suppress this system log and they will update it as known issue.

Kind Regards

Pavel

Re: Install Device Certificate for LogCollector CLI

mghazzi — Thu, 13 Mar 2025 18:19:13 GMT

The CLI command is:

request certificate fetch otp <actual-otp-from-CSP>

more info in this article: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/install-the-device-certificate-for-a-dedicated-log-collector