topic Re: Device Certificate fetch failure in General Topics

Device Certificate fetch failure

VLim — Fri, 09 Sep 2022 02:52:14 GMT

Version : 10.1.6-h3

Issue/ Error log : Failed to fetch device certificate. Failed to send request to CSP server. Error: No OCSP response received(dest => 35.222.13.89)

Tshoot : Generated OTP over support portal but no option for me to key in the OTP

KB unable to resolve : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE&lang=en_US%E2%80%A9

Require assist on the cli to key in the otp for device certicate

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Device Certificate fetch failure

David_Early — Mon, 12 Sep 2022 02:57:46 GMT

I'm seeing the same thing on a PA-410 and a new eval PA-VM when trying to fetch their device certificates.

On the PA-410, it's preventing ZTP from proceeding.

It looks like an issue at Palo with api.paloaltonetworks.com.

Re: Device Certificate fetch failure

kiwi — Wed, 14 Sep 2022 07:09:03 GMT

Hi @VLim ,

Not sure if you've tried the following.

Once you generate the OTP on the CSP log in to your next-generation firewall as an admin user.

Select Device > Setup > Management > Device Certificate and click Get certificate.
Paste the One-time Password you generated and click OK
The firewall should successfully retrieve and install the certificate.

As for cli, is this the command you were looking for ?

admin@PA-LAB> request certificate fetch otp <value>

This will trigger the job 'Device-certificate-fetch'.

Hope this helps,

-Kiwi.

Re: Device Certificate fetch failure

VLim — Tue, 20 Sep 2022 23:37:02 GMT

Seem Palo Alto take times for fetch new certificate, when I tried to execute few days later it shown success

Re: Device Certificate fetch failure

nkmehta — Wed, 01 Feb 2023 08:26:12 GMT

Command is not working

Re: Device Certificate fetch failure

kiwi — Wed, 01 Feb 2023 09:47:54 GMT

Hi @nkmehta ,

A bit more context would help us. What's the outcome when you try the command ? Are you seeing an error message ?

Cheers,

-Kiwi.

Re: Device Certificate fetch failure

VLim — Thu, 02 Feb 2023 07:46:20 GMT

The issues goes away by itself LOL

Re: Device Certificate fetch failure

rpolefka — Sat, 20 May 2023 15:26:24 GMT

I have a PA440 that is throwing No Device Certificate error. Go to Device, Setup tab to try to "Get Certificate" however no option to get certificate is available:

I'm trying to do this via CLI. When I try to:

request certificate fetch otp [what-is-this-value???]

i try pasting the OTP from the website and it gives me an error.

Re: Device Certificate fetch failure

rpolefka — Sat, 20 May 2023 15:38:52 GMT

Hmm ok well either I did something or it resolved itself.

I did

request certificate fetch

and then i got

Certificate fetch job enqueued with jobid 8418

Then went back to Management page and it was there...

Re: Device Certificate fetch failure

PBotchway — Tue, 05 Dec 2023 16:50:17 GMT

hello Vlim,

please this is the error im getting when trying to generate certificate

Error

request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

Re: Device Certificate fetch failure

Waly — Wed, 06 Dec 2023 06:25:49 GMT

Hello All,

I am having the same error;

request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

after copying the OTP from the support portal and pasting it in the get certificate

can anyone let me know how to resolve this issue?

Re: Device Certificate fetch failure

emr_1 — Wed, 06 Dec 2023 08:28:31 GMT

The availability of entering "otp" might be depends on your platform and version.

I'll show you two samples; one is pan-os 11.0 with PA-445, another is pan-os 10.2 with panorama.

===

admin@PA-445> show system info | match sw-version
sw-version: 11.0.2-h2
admin@PA-445>
admin@PA-445> request certificate fetch ?
<Enter> Finish input

admin@PA-445>

admin@Panorama> show system info | match sw-version
sw-version: 10.2.7
admin@Panorama>
admin@Panorama> request certificate fetch ?
* otp One time password to generate the certificatei

admin@Panorama>

===

As you can see, PA-445 does not have "otp" option.

Please check on your platform. You can check with entering "?" on your command.

Re: Device Certificate fetch failure

pius.botchway — Wed, 06 Dec 2023 12:25:32 GMT

Re: Device Certificate fetch failure

felipeorozco — Tue, 13 Aug 2024 16:41:46 GMT

We have an issue with the Firewalls 410 and 440 due we can't execute command for get certificate. We request support to Palo Alto on a case 😞

Re: Device Certificate fetch failure

wstuart — Tue, 11 Feb 2025 23:09:18 GMT

I know this is a really old topic, but I found this thread when I was trying to diagnose my own cert download issue.

I had a problem because my MGMT interface led to a different firewall for outbound that has SSL inspection. Since this changes the cert for the transaction, Palo Alto rejects the transaction. Setting "Palo Alto Networks Services" on the outside interface instead of MGMT fixed the issue. This is changed in Device > Setup > Services > Service Route Configuration.