topic Re: Master Key extending time issue in General Topics

Master Key extending time issue

TranceforLife — Fri, 21 Jul 2017 18:33:00 GMT

Hi All Experts,

I am currently having an issue while attempting to extend a Master Key validity time:

2017-07-21 00:08:20.473 +0100 ------------ Received event:3 (Cfg installed) in worker thread ------------

2017-07-21 00:08:20.475 +0100 [3] Reading mkey, ks files...

2017-07-21 00:08:20.475 +0100 [3] Get fips/cc mode, event_type

2017-07-21 00:08:20.482 +0100 [3] Begin to read master keys into mkobj

2017-07-21 00:08:20.483 +0100 Reading /opt/pancfg/.keystore/mkey.xml file into sysd dict

2017-07-21 00:08:20.484 +0100 [3] Read keystore file into cryptod_keystore dict

2017-07-21 00:08:20.484 +0100 Reading /opt/pancfg/.keystore/ks.xml file into sysd dict

2017-07-21 00:08:20.485 +0100 -- Reading startup keys files from disk, query:0 --

2017-07-21 00:08:20.485 +0100 -- Done reading and deleting 0 startup keys files from disk --

2017-07-21 00:08:20.486 +0100 [3] Done reading mkey and keystore files

2017-07-21 00:08:20.486 +0100 Mkey expiry timer stopped

2017-07-21 00:08:20.486 +0100 Mkey reminder timer stopped

2017-07-21 00:08:20.486 +0100 Starting reminder ager for mkey for 1590447 seconds from now

2017-07-21 00:08:20.486 +0100 Starting expiry ager for mkey for 4182447 seconds from now

2017-07-21 00:10:15.243 +0100 Error: pan_cryptod_sysd_decr_recv_cb(pan_cryptod_crypt.c:1571): Decryption failed, abort

Thanks to All,

pinging: @reaper @Remo @BPry

Re: Master Key extending time issue

Remo — Fri, 21 Jul 2017 18:55:30 GMT

@TranceforLife

Good question 😛

What character set did you you use for the new key? May be you used a character that is "not supported" --> bug

Did you try with only alphanumeric characters?

Re: Master Key extending time issue

TranceforLife — Mon, 24 Jul 2017 13:33:42 GMT

Hi @Remo,

Thanks for your feedback. l have followed this guide:

https://live.paloaltonetworks.com/t5/Management-Articles/Character-Limitation-for-Setting-Up-Master-Key-on-Palo-Alto/ta-p/61016

I can see it is complaining about some private SSL cert key, but not sure why!!!!

Re: Master Key extending time issue

Remo — Mon, 24 Jul 2017 14:41:12 GMT

Hi @TranceforLife

Sorry for asking again ... Just to make sure that it is not related to a bug with a special character, you tried with something as easy (without special characters) as "password12345678"?

Re: Master Key extending time issue

TranceforLife — Mon, 24 Jul 2017 16:17:25 GMT

Exactly simple password, it is something to do with the private key of the ssl cert. Maybe it needs to re-upload. Not sure (

Re: Master Key extending time issue

Remo — Thu, 27 Jul 2017 18:24:57 GMT

@TranceforLife

PAN-79780? --> fixed in 8.0.4

Re: Master Key extending time issue

TranceforLife — Mon, 31 Jul 2017 14:43:44 GMT

Hi @Remo,

Thanks. This is now with TAC and l think we are looking into the "wrong master key" scenario. Yes, l know ...... So current key most likely is not valid (wrong key). Don't ask me how it happened :D, but a workaround is quite tedious (reset the device to its default and re-type all config PASSWORDS manually).

Re: Master Key extending time issue

TranceforLife — Fri, 28 Jul 2017 14:39:21 GMT

Indeed the wrong MK.