topic Re: Remove Device Certificate in General Topics

Remove Device Certificate

jwill2 — Wed, 15 May 2024 14:42:29 GMT

We would like to remove the device certificate from a couple of our firewalls. We don't use or need the device certificates at this time and would prefer them not be installed.

I tried to do a factory reset and the certificate automatically downloaded and installed itself.

Re: Remove Device Certificate

Claw4609 — Thu, 16 May 2024 13:02:48 GMT

Hello,

What are you needing to remove the device certificate entirely for? Its used for various communication with PAN services. If you would want to the device to not grab its device certificate you would need to block the connection to the CSP.

Re: Remove Device Certificate

reaper — Thu, 16 May 2024 13:08:22 GMT

Why would you not want it there? it's (only) used for secure communication with Palo Alto cloud services so won't be used if you have no cloud subscriptions

If you want to 'break' it, you could generate a new OTP via the support portal and then simply not import it onto your firewall (but again to my first line, why would you not want it there?)

Re: Remove Device Certificate

jwill2 — Thu, 16 May 2024 15:49:27 GMT

We do not have device certificates on any of our other devices. It was just odd that the cert seemed to auto-install on this firewall (a 5410 on 10.2.x). We don't use any of the cloud services and I didn't create a OTP through the support portal. It was requested by a senior member of our team to remove it. I'm guessing because we don't use any of the services.

I also noticed that the certificate auto installed on some new 440's that we are working on deploying.

I found out from our SE that I would need root access via TAC in order to try to remove it, and that doesn't guarantee it won't reinstall itself.

I plan on leaving it for now.

Re: Remove Device Certificate

GiannaFlores — Mon, 03 Jun 2024 13:44:07 GMT

Can I ask a question related to this?

Re: Remove Device Certificate

reaper — Tue, 04 Jun 2024 08:21:18 GMT

ofcourse!

Re: Remove Device Certificate

MarkChapman1 — Thu, 13 Jun 2024 07:33:59 GMT

@jwill2 wrote:

We would like to remove the device certificate from a couple of our firewalls. We don't use or need the device certificates at this time and would prefer them not be installed.

I tried to do a factory reset and the certificate automatically downloaded and installed itself.

To prevent automatic certificate installation after a factory reset, ensure to disconnect from any network during setup or configure network settings to avoid automatic downloads.