topic Problem with the DuckDNS certificate for the DDNS service. in General Topics

Problem with the DuckDNS certificate for the DDNS service.

A.Kuszaj — Fri, 18 Jul 2025 08:21:14 GMT

Hi,
I'm having an issue with Palo Alto and DDNS — specifically with DuckDNS. Everything had been working fine for the past two years, but for about a month now, Palo Alto is showing an SSL certificate error.
The exact error message is:

Server response: Peer certificate cannot be authenticated with given CA certificates

I’m not sure which certificate I should be using to fix this.
Has anyone encountered and resolved this issue?

Re: Problem with the DuckDNS certificate for the DDNS service.

kiwi — Fri, 18 Jul 2025 08:41:16 GMT

Hi @A.Kuszaj ,

Root and intermediate CA certificates expire, or new ones are issued, and the Palo Alto firewall's trusted CA store needs to be updated to reflect these changes. Since it was working for two years and stopped about a month ago, it's probable that a certificate in DuckDNS's chain either expired or was updated, and your firewall hasn't updated its trusted CA store accordingly. Possibly you may have to install and set the Intermediate Certificate as a Trusted Route CA. You may have to delete and recreate the Certificate Profile for this to take effect.

Here are a few things you can check:

Clarify which certificate chain you have installed to the firewall ? Refer to the article link to install correct intermediate CA on the firewall: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC

Validate the DDNS configurations referring to this document link: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-dynamic-dns-for-firewall-interfaces

Please refer to this article link providing resolution for Error message: Peer certificate cannot be authenticated with given CA certificates: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLz3CAG&lang=en_US%E2%80%A9

Hope this helps,

-Kim.

Re: Problem with the DuckDNS certificate for the DDNS service.

akolodziej — Mon, 28 Jul 2025 14:17:41 GMT

I had the same issue. You'll need the "Amazon RSA 2048 M02" and "Amazon Root CA 1" and create a new cert profile for DuckDNS. Click the download link next to "Additional Certificates (if supplied)". Copy the middle and last cert in the chain and create new PEM files in notepad.