topic SSL Connection Error During Panorama-Orchestrated HA Upgrade in General Topics

SSL Connection Error During Panorama-Orchestrated HA Upgrade

M.Knabikas — Fri, 27 Mar 2026 08:27:45 GMT

Hi all,

First time posting, so bear with me. We manage fairly large fleets of devices across multiple clients, so the new HA upgrade orchestration from Panorama looked like a big time-saver. We decided to test it with one client but ran into the issue shown in the screenshot: "Download error: SSL connection error".

Has anyone encountered this — either with orchestrated HA upgrades or standalone upgrades — and have an idea where to start troubleshooting?

Some additional context:

Both firewalls had same PAN-OS base version downloaded on them
Both can reach the update server (updates.paloaltonetworks.com)
Device certificates are valid and up to date

Appreciate any insights or discussion.

Re: SSL Connection Error During Panorama-Orchestrated HA Upgrade

kiwi — Fri, 27 Mar 2026 09:16:29 GMT

Hi @M.Knabikas ,

Make sure that TCP port 28443 is open in this communication and no intermediate device is blocking traffic.

28443 TCP - Used for managed devices (firewalls and Log Collectors) to retrieve software and content updates from Panorama.
Only devices that run PAN-OS 8.x and later releases retrieve updates from Panorama over this port.

Source:

https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/reference-port-number-usage/ports-used-for-panorama

Hope this helps !

Re: SSL Connection Error During Panorama-Orchestrated HA Upgrade

M.Knabikas — Mon, 20 Apr 2026 07:40:10 GMT

Hi,

Thanks for the follow-up!

Yes, opening TCP 28443 was the solution. Note that the direction matters — the port needs to be open from Panorama to the managed firewalls, not the other way around.

The feature works well overall. One minor issue we noticed: the update window would occasionally get stuck visually on a step (e.g., "upgrading second firewall") even after that firewall had already completed the upgrade. This appears to be a display/UI glitch only — functionality was not affected.