topic Re: Device Certificate Expired 'Invalid Request. Authentication Failed' in General Topics

Device Certificate Expired 'Invalid Request. Authentication Failed'

aavezzano — Mon, 22 Aug 2022 19:16:14 GMT

Hi Everybody,

I have 4 firewalls grouped into 2 HA pairs. The first pair had certificates which expired on August 18 and have failed to be renewed. The last fetched message says "Failed to renew device certificate. Invalid request. Authentication failed". I tried going through the OTP process to redeploy the certificate but under Device > Setup > Management > Device Certificate the "Get Certificate" button is no longer there. I also cannot deploy through Panorama as the devices are no longer connected (which I believe is due to the failed certificate request.

The second pair of firewalls has certificates which are expiring in a couple of days. These also have failed to renew the certificates citing the same errors.

Which authentication is failing here? I'm really not sure where to go from here to fix things. Any ideas?

Thanks for any help!

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

aavezzano — Tue, 23 Aug 2022 17:39:18 GMT

I've found the issue. I ran across the KB article here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE

Changing the MTU to 1374 fixed the issue for me.

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

LCMember40912 — Mon, 17 Apr 2023 15:54:10 GMT

I tried changing the mgmt int MTU to 1374 and committed, but can't tell if it worked yet because the 'Get certificate' button is still not there!

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

aavezzano — Mon, 17 Apr 2023 16:01:59 GMT

Try running the following in CLI:

request certificate fetch

show device-certificate status

configure

commit force

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

LCMember40912 — Mon, 17 Apr 2023 16:09:55 GMT

'request certificate fetch' worked to renew the cert without an OTP, but 'Get certificate' link is still not there. Doesn't seem an issue now, but still no bueno...

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

billperp — Mon, 17 Apr 2023 18:17:41 GMT

Thanks. request certificate fetch fixed it for me. I've had this error several times on a PA-460 running the latest preferred releases of firmware.

Re: Device Certificate Expired 'Invalid Request. Authentication Failed'

mdelong — Mon, 03 Jul 2023 21:07:19 GMT

Thanks for adding this command for us dude! After fixing the MTU I ran this to test it immediately and it fixed it for me! Great deets!