topic Re: Enterprise PKI Cert Chain Error in General Topics

Enterprise PKI Cert Chain Error

rjdahav163 — Wed, 22 Nov 2017 09:41:43 GMT

Hello

we have our enterprise CA and our PA firewalls have signed certs from it. Now for our captive portal, we also have a certi signed from our enterprise CA. Everything works and there is no browser error for certificate.

But in the FW commit, we get a warning "Warning: cannot find complete certificate chain for certificate ..."

I found the following KB for a Public CA

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed-by-a-Public-CA/ta-p/55523

and I also tried the Workaround mentioned at the bottom of the KB, but it does not work.

Any suggestions?

Thanks and Regards,

Re: Enterprise PKI Cert Chain Error

bmorris1 — Wed, 22 Nov 2017 09:52:36 GMT

Hi @rjdahav163

My advice would be to take a look at the certificate hierarchy in Windows, are you seeing the full chain there that is expected when you open up the file?

Example here, taken from the live community website:

hope this helps,

Ben

Re: Enterprise PKI Cert Chain Error

rjdahav163 — Wed, 22 Nov 2017 10:34:55 GMT

Hi @bmorris1

Yes I see the complete chain in the hierarchy as expected and installed the same on FW but still firewall complains. 😞

Regards,

Re: Enterprise PKI Cert Chain Error

RVizcarra — Tue, 27 Jun 2023 07:47:14 GMT

Hi @rjdahav163 , have you resolved this issue? I'm having the same.

Re: Enterprise PKI Cert Chain Error

rjdahav163 — Mon, 18 Sep 2023 04:36:08 GMT

@RVizcarra Yes.. I uploaded certificates one by one, starting from the device cert, then intermediate cert and then the root cert.

Re: Enterprise PKI Cert Chain Error

aleksandar.astardzhiev — Mon, 18 Sep 2023 11:57:40 GMT

Hi @rjdahav163 , @RVizcarra ,

I have noticed that when generating certificate from our internal Windows PKI and opeing the cert with text editor it looks like PKI is listing the full chain (the root, the intermiediate, the server and then the key), but the order is wrong. In my experience the root and the intermediate order was mixed and if put them in correct order (root, intermediate, server) and then upload it palo fw. After that the warning is gone.