topic Re: Duplicate Certificate Subject Found in General Topics

Duplicate Certificate Subject Found

Radmin_85 — Fri, 02 Feb 2018 07:42:34 GMT

Hi all

Cant get rid off this warning.we have deleted all duplicate certificates but couldnt get out of this warning when commit something

Re: Duplicate Certificate Subject Found

Mick_Ball — Fri, 02 Feb 2018 10:13:58 GMT

is this a wildcard cert...

it may be that you have a wild cart cert for *.fred.smiff.com and also a cert for just smiff.com.

Re: Duplicate Certificate Subject Found

Mick_Ball — Fri, 02 Feb 2018 10:25:27 GMT

no cancel that... obviously that would apply to all ".com" certs...

I did have a similar issue with licensing, tried to add new and told already activated, although it had been removed..

had to go via cli to remove it as not showing in GUI.

you could view all installed certs with one of the options under :-

show sslmgr-store

Re: Duplicate Certificate Subject Found

Radmin_85 — Fri, 02 Feb 2018 10:28:36 GMT

Yes it is wildcart cert
Can you please give me instructions how to solve it?

Re: Duplicate Certificate Subject Found

BPry — Fri, 02 Feb 2018 14:33:01 GMT

@Radmin_85,

Once you've commit the configuration to ensure that any removals you've made have actually taken place, take a look at the certificate store and see if any of your listed certificates happen to have the same CN.

If it doesn't show up in the GUI I would verify with the 'show sslmgr-store config-ca-certificate' command that you don't have a stale cert hiding in the config.

Re: Duplicate Certificate Subject Found

Marivi — Mon, 26 Feb 2018 14:05:10 GMT

hello if you found the duplicate cert with the command show sslmgr-store config-ca-certificate, how can you delete the stale cert hiding in the config?

Re: Duplicate Certificate Subject Found

Mick_Ball — Mon, 26 Feb 2018 14:40:10 GMT

@Marivi,Good point...

I would have thought "delete sslmgr-store config-ca-certificate <certificate name>

but i thought wrong...

I can only see this option in "configure" mode but that's for web-server, forward-trust and forward-untrust.

Have you found a duplicate hidden cert or just asking?

Re: Duplicate Certificate Subject Found

Marivi — Mon, 26 Feb 2018 14:48:00 GMT

I have found a duplicate hidden, i have done >debug dataplane reset ssl-decrypt certificate-cache but this don't fix the problem, I have found next command > debug sslmgr delete crl all which do the same in management plane. I will inform you if the second command fix the problems... thank you for you fast answer

Re: Duplicate Certificate Subject Found

Mick_Ball — Mon, 26 Feb 2018 15:04:05 GMT

@Marivi

try this...

configure

delete shared ssl-decrypt trusted-root-ca ?

delete shared ssl-decrypt trusted-root-ca <certificate name>

Re: Duplicate Certificate Subject Found

Mick_Ball — Mon, 26 Feb 2018 15:05:12 GMT

no good...

no object to delete in delete handler

Re: Duplicate Certificate Subject Found

Mick_Ball — Mon, 26 Feb 2018 15:08:52 GMT

OK...

configure

delete shared certificate ?

delete shared certificate <certificate name>

works for me.....

Re: Duplicate Certificate Subject Found

Ilya_Kuranov — Tue, 14 Aug 2018 07:44:51 GMT

I met the same issue, but found a problem in Network > Global Protect > Portals > GlobalProtect Portal Configuration > Agent > TrustedRoot CA. There was a certificate, whos CN duplicated the other one. But that certificate wasn't in the Certificates list in Certificates management.

Hope it will help somebody.

Re: Duplicate Certificate Subject Found

Johnan — Mon, 06 Apr 2020 18:51:30 GMT

Hi,

Hoping to revive this thread, I'm having the exact same issue.

Certificates visible with 'show sslmgr-store config-ca-certificate' and under 'Network > GlobalProtect > Portals' and under Agent Configuration and the Dropdown menu for Trusted Root CA. But nowhere else...

I've tried everything I can think of, the certificate is not available under the delete and debug commands, even in configuration mode.

I'm currently on release 9.0.x but I don't think this is associated with a particular release.

Did anyone find a solution for this?

Re: Duplicate Certificate Subject Found

JackSenesap — Thu, 30 Apr 2020 12:21:00 GMT

I'm also having the exact same issue and on 9.0.x

This is a problem.

Re: Duplicate Certificate Subject Found

marioveloz — Mon, 18 May 2020 22:33:53 GMT

I'm also having this problem but running version 8.1.14.

This problem started when a certificate expired. I selected the certificate and tried to renew it, but the firewall gave an error message saying that it could not read the certificate. I later made another certificate, with the intent of configuring it into the place of the expired certificate, with the same IP address. Just for fun, I tried renewing the certificate and it successfully renewed it.

I deleted the freshly created certificate that was still unused, but started receiving the error on commits. The certificate exists in some form in the GUI (provided for an option for GlobalProtect TrustedRootCA), but does not exist in Device > Certificate > Certificate management.

It exists in the CLI as well, but I'm unsure of the command to delete the certificate.

Help appreciated!

Re: Duplicate Certificate Subject Found

Jorge-Sanchez — Wed, 05 Aug 2020 23:10:34 GMT

Hi,

I had the exact same problem. It was a Wildcard certificate that for some reason was loaded 2 times (I think a browser error), I tried to delete the certificate from CLI since GUI did not see it, but this was not possible. From CLI I only got the name of the duplicate certificate and followed the instructions of the link:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POcWCAW&lang=en_US%E2%80%A9

You just have to be careful and now, it worked well for me.

I hope it helps. good day!

Re: Duplicate Certificate Subject Found

mhuddleston — Fri, 12 Nov 2021 14:35:19 GMT

Please use the document found in teh link below to resolve your issue.

How to clear the duplicate certificate subject found warning when issuing a commit command.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POcWCAW&lang=en_US%E2%80%A9