topic Re: urlfiltering.paloaltonetworks.com - certficate revoked?? in General Topics

urlfiltering.paloaltonetworks.com - certficate revoked??

RSKadish — Fri, 26 Aug 2016 20:41:16 GMT

Is anyone else having a problem browsing to urlfiltering.paloaltonetworks.com? We can't get to it from here. We are being told that the certficate has been revoked. (SEC_ERROR_REVOKED_CERTIFICATE)

I tried two different paths to the Internet from our corporate network with the same results. The rest of paloaltonetworks.com is accessible.

Thanks,

- Steve

Re: urlfiltering.paloaltonetworks.com - certficate revoked??

reaper — Mon, 29 Aug 2016 07:54:42 GMT

Hi Steve

The certificate for urlfiltering.paloaltonetworks.com was renewed on the 23rd, could you verify if you were having issues connecting to the CA at certs.godaddy.com [ 173.201.19.2 ] ?

Re: urlfiltering.paloaltonetworks.com - certficate revoked??

Brandon_Wertz — Mon, 29 Aug 2016 13:03:56 GMT

@reaper Out of curiousity why does the site require a captcha twice? If one needs to be provided to "test" a site which validates we're a human why is the follow-on site requiring it again?

Re: urlfiltering.paloaltonetworks.com - certficate revoked??

reaper — Mon, 29 Aug 2016 13:29:25 GMT

Hi @Brandon_Wertz

the second page gives you the output of the URL you put in on the 1st page + the possibility to do another query for a second url + corresponding captcha for a second lookup.

I'm assuming the lookup is stateless and will always request a captcha (for every lookup) to prevent abuse

the output of a preceding lookup is probably injected in an iframe in between the 2 boxes

Re: urlfiltering.paloaltonetworks.com - certficate revoked??

RSKadish — Mon, 29 Aug 2016 13:35:32 GMT

Good morning,

The problem seems to have cleared up over the weekend. I assume that it was either the SSL state cache in our browsers or in our firewall that needed to catch up.

Best,

- Steve

Re: urlfiltering.paloaltonetworks.com - certficate revoked??

Brandon_Wertz — Mon, 29 Aug 2016 13:38:22 GMT

Thanks for the response @reaper. Seems like moral of the story just use the firewall to request the change. lol Issue with that though is there's no e-mailed response.