topic Re: I can't perform a dynamic update on the PA-460 in General Topics

I can't perform a dynamic update on the PA-460

D.Watanabe454116 — Tue, 07 Jul 2026 10:24:58 GMT

Hi,When I ran “Device > Dynamic Updates > Check Now” on the PA-460, the following error was displayed.

Failed to check Content upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again. Failed to check IoT upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again. Failed to check Antivirus upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again.

The device information is as follows:・PAN-OS: 12.1.6・DNS server: 8.8.8.8・Proxy server: None・Management plane has been restarted* >debug software restart process management-server・Can connect to updates.paloaltonetworks.com・The latest version of the “Applications and Threats” signature has been installed (July 7, 2026)・Confirmed that dynamic updates are possible when the checkbox for “Verify Update Server ID” under Device > Services is unchecked・Error log under Device > System

■description contains 'Failed to check Antivirus content upgrade info due to SSL peer certificate or SSH remote key was not OK■description contains ‘Failed to check Content upgrade info due to SSL peer certificate or SSH remote key not being OK’■description contains ‘Failed to check IoT content upgrade info due to SSL peer certificate or SSH remote key not being OK’

Could you please provide any information regarding a solution?

Best regards,Daisuke

Re: I can't perform a dynamic update on the PA-460

kiwi — Tue, 07 Jul 2026 11:17:22 GMT

Hi @D.Watanabe454116 ,

Sounds like you might be running into a known issue where hashed symlinks to predefined CA certificates may be missing.

As a result, this prevents from verifying the update server certificate chain even though the certificate exists in the store.

To resolve this issue, one must rebuild the hashed symlinks for all predefined trusted root CAs from the root shell (TAC only).

I've seen scenarios where upgrading the PAN-OS version also fixed this.

Please reach out to TAC in order to confirm you're hitting this exact issue.

Kind regards,

Re: I can't perform a dynamic update on the PA-460

D.Watanabe454116 — Wed, 08 Jul 2026 02:39:21 GMT

Hi @kiwi

Thanks for getting in touch.

I upgraded the OS to 12.1.7 today, then tried downgrading to 12.1.6, and the update went through just fine.

It’s all thanks to your advice. I really appreciate it.

Best regards,
Daisuke