topic Re: API error messages in General Topics

API error messages

s0lselcia — Mon, 16 Sep 2024 15:17:45 GMT

Hi all

This error message keeps coming up:

The latest API KeyGen was executed on <date and time> with the deprecated algorithm. You are advised to configure the more secure API key infrastructure by web interface: Setup -> Management -> Authentiation Settings -> API Key Certificate, or by CLI: set deviceconfig setting management api key certificate

API certificate is not even set up.

This has happened over 100 times in the system logs. Can this error be stopped and how will it affect the admin users?

Re: API error messages

BPry — Mon, 16 Sep 2024 19:09:12 GMT

@s0lselcia,

What version of PAN-OS are you using at the moment? This was a known issue with 11.0's early releases, but that should have always been present as soon as you loaded PAN-OS.

Re: API error messages

s0lselcia — Mon, 16 Sep 2024 20:40:44 GMT

Thanks for the response. Sorry, I did not mention the version.

PAN-OS: 11.1.2-h3 (jumped from 10.2 straight to 11.1.2-h3) Platform: PA-3220.

Re: API error messages

CognitionPlus — Tue, 17 Sep 2024 14:47:50 GMT

we are getting the same warning starting yesterday 21:16 pm on PAN-OS 11.2

Re: API error messages

SeSchulte — Thu, 19 Sep 2024 08:59:46 GMT

Hello everyone,

@s0lselcia: You can fix the error by simply adding a certificate for the API key creation under the Authentication Seetings.
See here:
https://docs.paloaltonetworks.com/whats-new/november-2023/api-key-certificate

What I am wondering at this point is which certificate attributes must be stored in the certificate so that it can be used to generate the API key?
Does anyone know this?
Unfortunately I can't find it in the article shared above!

greetings...

Re: API error messages

s0lselcia — Thu, 19 Sep 2024 11:16:37 GMT

Thanks for the response.

But why would you need to create one if it's never been set up and will never be used?

Re: API error messages

SeSchulte — Thu, 19 Sep 2024 14:52:28 GMT

Hey s0lselcia,

Sure, you're welcome.

APIs will become increasingly important in the administration of firewalls and network hardware over the next few years.
I think that's why Palo is trying to make the protection and generation of API keys secure!

greetings....

Re: API error messages

s0lselcia — Thu, 19 Sep 2024 15:28:43 GMT

Thanks again.

Is there any way to remove this error without configuring the API key?

Re: API error messages

SeSchulte — Tue, 24 Sep 2024 12:29:06 GMT

Hey s0lselcia,

sorry for my late response.

If I understood correctly from the knowledge base articles, you can only fix the warning by adding a certificate under “Setup > Management > Authentication Settings”.
Here again the link to the article:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-api-authentication/generate-an-api-key-certificate

I think it is easiest to use a device certificate that you have already used to secure the Panorama Web GUI.

Greetings

Re: API error messages

s0lselcia — Tue, 24 Sep 2024 18:03:26 GMT

Thanks for the response. The problem with configuring these certificates, it will affect the current admin's access, which is a problem. I would rather just be able to turn the message off.

Re: API error messages

tshooter — Fri, 10 Jan 2025 18:52:12 GMT

When you say straight to , do you mean one reboot to 11.1.2-h3 ? always thought had to go 10.2 >> 11.0.X >> 11.1.X >> 11.2.X. ... ? no ?

Re: API error messages

AlyssaWright982 — Sun, 12 Jan 2025 13:27:07 GMT

thanks.this is very necessary information for me right now everything i am looking for is here thanks

Re: API error messages

s0lselcia — Mon, 13 Jan 2025 16:29:47 GMT

I mean directly:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path

Re: API error messages

Chris-Gapske — Mon, 07 Apr 2025 21:25:30 GMT

I normally don't want to hate on Palo Alto but this is just stupid. They should auto create a local cert. Instead it has been a huge pain.

Re: API error messages

shravant3 — Wed, 09 Apr 2025 07:10:52 GMT

Check this article:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HDcJCAW

Re: API error messages

mghazzi — Sun, 30 Nov 2025 20:37:57 GMT

I fixed it on sw-version: 11.2.10 like this.. (7300 is the max allowed number of days - 20yrs), enjoy:

> request certificate generate ca yes days-till-expiry 7300 algorithm RSA rsa-nbits 4096 certificate-name API-test name API-test

> configure
# set deviceconfig setting management api key certificate API-test
# commit

Re: API error messages

mghazzi — Sun, 30 Nov 2025 20:56:15 GMT

It is not complaining about the presence or absence of the API Key, but rather the certificate to be used by the API-key, you don't need to configure an API-key to get rid of the error, you just need to choose/create a cert to be used by the API-key should you ever configure the API key. Basically, for your security, Palo is getting out of the business of providing factory created certs, and now they want the user to generate certs locally or provide them via CA, but factory-provided certs have become a liability for obvious reasons.