Can't find where an SSL cert is in use

Matt_Harrell — Fri, 06 Dec 2013 16:23:37 GMT

I'm trying to delete an SSL certificate from a Palo Alto cluster I'm setting up via Panorama. It tells me the cert cannot be deleted due to this reason:

because of references from:

template -> {firewall cluster name} -> config -> devices -> localhost.localdomain -> vsys -> vsys1 -> captive-portal -> server-certificate

I remember messing around with Captive Portal and it did involve this certificate, but when I check the Captive Portal section of the configuration, either in Panorama, or in the primary/active firewall, there's nothing there at all. Any thoughts on where to find this?

Re: Can't find where an SSL cert is in use

tasonibare — Sat, 07 Dec 2013 21:56:47 GMT

mhar,

You might have to go into CLI to dissociate the cert from captive-portal.

1. On the primary device and/or panorama, verify that the cert is still associated with CP

> set cli config-output-format set

> configure

# show

(Use the "/set captive-portal" to search for the current captive-portal configuration on the device)

2. Delete the cert from CP

# delete captive-portal server-certificate

You should now be able to delete the certificate unless it's being referenced somewhere else

-tasonibare

topic Can't find where an SSL cert is in use in General Topics

Can't find where an SSL cert is in use

Re: Can't find where an SSL cert is in use