topic Re: Device Certificate: can't replace old device cert by putting in newly generated OTP in General Topics

Device Certificate: can't replace old device cert by putting in newly generated OTP

tomsheldon — Mon, 20 Mar 2023 18:22:19 GMT

I did a dumb thing. I wanted to extend the validity period of the current device certificate, so I went to live.paloaltonetworks and generated a new OTP. However, back on the firewall, I find that the "get certificate" button is not available. It just shows that the current certificate is valid. I think the mismatch is generating these errors in the system log:

CloudAuthService Server certificate validation failed. Dest Addr: app-registry-service.apps.paloaltonetworks.com, Reason: self signed certificate in certificate chain

How do I delete or reset the current device certificate and reinstate the "get certificate" button so I can enter the new OTP?

Re: Device Certificate: can't replace old device cert by putting in newly generated OTP

kiwi — Tue, 21 Mar 2023 09:43:07 GMT

Hi @tomsheldon ,

Can you try using the CLI ?

admin@PA-LAB> request certificate fetch otp <value>

This should trigger the job 'Device-certificate-fetch'.

Hope this helps,

-Kiwi.

Re: Device Certificate: can't replace old device cert by putting in newly generated OTP

tomsheldon — Tue, 21 Mar 2023 16:03:42 GMT

Thanks Kiwi,

I had tried that command the other day without success, but your messages reassured me I should try it again.

This time, I typed "request certificate fetch" (without otp) and it worked.

Re: Device Certificate: can't replace old device cert by putting in newly generated OTP

BlackWater — Tue, 16 Apr 2024 18:08:12 GMT

What was the fix ? I am experiencing the same issue ?

Re: Device Certificate: can't replace old device cert by putting in newly generated OTP

JeanPaul222 — Wed, 19 Feb 2025 13:28:24 GMT

you found a fix?