https://live.paloaltonetworks.com/t5/general-topics/scep-on-panorama-error/m-p/560267#M113583 <P>We're testing SCEP on Panorama and getting an error saying "Unable to generate SCEP certificate, Certificate CA Retrieval Failed". Doing a tcpdumb nothing immediately sticks out, there is not untrusted CA error or anything like that. Is there any indication of what to look for to address this? System logs basically just say sslmgr SCEP certificate failed.&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Claw4609_0-1696269367816.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/54106iECBCAA2A3B15A2E4/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="Claw4609_0-1696269367816.png" alt="Claw4609_0-1696269367816.png" /></span></P> <P>&nbsp;</P> <P>In sslmgr logs I am seeing:&nbsp; Failed to handle op command for agent</P> <P>&nbsp;</P> Mon, 02 Oct 2023 18:25:51 GMT Claw4609 2023-10-02T18:25:51Z https://live.paloaltonetworks.com/t5/general-topics/scep-on-panorama-error/m-p/560267#M113583 <P>We're testing SCEP on Panorama and getting an error saying "Unable to generate SCEP certificate, Certificate CA Retrieval Failed". Doing a tcpdumb nothing immediately sticks out, there is not untrusted CA error or anything like that. Is there any indication of what to look for to address this? System logs basically just say sslmgr SCEP certificate failed.&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Claw4609_0-1696269367816.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/54106iECBCAA2A3B15A2E4/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="Claw4609_0-1696269367816.png" alt="Claw4609_0-1696269367816.png" /></span></P> <P>&nbsp;</P> <P>In sslmgr logs I am seeing:&nbsp; Failed to handle op command for agent</P> <P>&nbsp;</P> Mon, 02 Oct 2023 18:25:51 GMT https://live.paloaltonetworks.com/t5/general-topics/scep-on-panorama-error/m-p/560267#M113583 Claw4609 2023-10-02T18:25:51Z https://live.paloaltonetworks.com/t5/general-topics/scep-on-panorama-error/m-p/560294#M113587 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/227075">@Claw4609</a>&nbsp;</P> <P>&nbsp;</P> <DIV class="slds-form-element__control slds-grid itemBody" data-aura-rendered-by="106:66902;a"><SPAN class="test-id__field-value slds-form-element__static slds-grow " data-aura-rendered-by="107:66902;a"><SPAN class="uiOutputTextArea" data-aura-rendered-by="97:66902;a" data-aura-class="uiOutputTextArea">The message in the screenshot indicates that certificate generation failed while trying to generate on the Firewall/Panorama using the SCEP profile. This could occur if '<STRONG><A href="https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/anonymousauthentication" target="_self">Anonymous Authentication</A>'</STRONG><SPAN>&nbsp;is&nbsp;disabled in Windows Server IIS Manager. Enable it and check the status.</SPAN></SPAN></SPAN></DIV> <DIV class="slds-form-element__control slds-grid itemBody" data-aura-rendered-by="106:66902;a">&nbsp;</DIV> <DIV class="slds-form-element__control slds-grid itemBody" data-aura-rendered-by="106:66902;a">&nbsp;</DIV> <DIV class="slds-form-element__control slds-grid itemBody" data-aura-rendered-by="106:66902;a">&nbsp;</DIV> Tue, 03 Oct 2023 02:35:07 GMT https://live.paloaltonetworks.com/t5/general-topics/scep-on-panorama-error/m-p/560294#M113587 akuzhuppilly 2023-10-03T02:35:07Z