topic Re: Error generating a new certificate in General Topics

Error generating a new certificate

BigPalo — Tue, 12 Nov 2019 09:42:21 GMT

Hi, we are trying to generate a new elf-signed certificate in Panorama and we receive this error: Failed to insert certificate into configuration. Failed to find beginning of certificate. Make sure certificate starts with BEGIN CERTIFICATE tag.

This is the certificate and the error:

Why are we receiving this error?

Re: Error generating a new certificate

BPry — Tue, 12 Nov 2019 22:22:50 GMT

@BigPalo,

What version of Panorama are you running?

Re: Error generating a new certificate

BigPalo — Wed, 13 Nov 2019 07:40:36 GMT

version is 8.1.9-h4

Re: Error generating a new certificate

rnobrega — Tue, 21 Jan 2020 19:34:49 GMT

Did you ever figure this out? I am seeing the same thing.

Re: Error generating a new certificate

BPry — Tue, 21 Jan 2020 19:41:45 GMT

@rnobrega,

Outside of a few software bugs present in specific PAN-OS versions, this is almost always caused by an actual malformed certificate. The firewall itself is performing a pretty basic check as far as looking at the certificate, ensure that your certificate is actually formatted correctly.

Re: Error generating a new certificate

rnobrega — Tue, 21 Jan 2020 19:49:11 GMT

Figured it out. It was Panorama permissions.

Re: Error generating a new certificate

Deepak_K — Thu, 07 May 2020 10:02:43 GMT

We are facing same issue. Where to check panorama permission?

Re: Error generating a new certificate

fatboy1607 — Thu, 07 May 2020 10:10:32 GMT

what permissions are required on panorama ?

Re: Error generating a new certificate

BigPalo — Thu, 07 May 2020 10:21:11 GMT

In our case, this issue was solved by itself. Customer thought maybe any change in the week caused this, but not sure.

Re: Error generating a new certificate

Ilya_Kuranov — Thu, 23 Jul 2020 12:29:43 GMT

I also have the same problem, but only on Panorama (9.0.9). I can import the same certificate on NGFW.

Did anyone open a case?

Re: Error generating a new certificate

Deepak_K — Thu, 23 Jul 2020 12:39:10 GMT

In my case issue resolved next day automatically.

Re: Error generating a new certificate

Magnus_App — Tue, 31 Jan 2023 11:43:04 GMT

Solved by using Firefox instead of Edge

Re: Error generating a new certificate

segap — Fri, 29 Sep 2023 10:07:57 GMT

Solved by using Chrome instead of Firefox. 🙂

Re: Error generating a new certificate

natman-smhi — Thu, 05 Oct 2023 11:08:06 GMT

Had issues importing certificates into Panorama running 10.2.4h4 using Firefox. Worked fine directly on the firewall on the same version. Changed browser to Chrome and it worked like a charm in Panorama.

Re: Error generating a new certificate

ChrisThornton — Tue, 14 Nov 2023 03:28:23 GMT

I had the issue on 11.0.3 with Chrome and switched to Firefox. I was able to upload certs.

Re: Error generating a new certificate

LanceBereck — Tue, 13 Feb 2024 02:21:06 GMT

Just had the same here using Chrome & POS version 11.0.3. I generated one cert on one FW with no issue via Panorama. When I attempted the second FW I got "Failed to insert CSR into configuration. Internal error. Failed to insert xml node."

While I was mucking about trying things I also got "Failed to insert certificate into configuration. Only self signed CA certificates can have identical subject and issuer fields."

Ctrl+F5 didn't help so I just logged out of Panorama and back in and it went through fine with the exact same settings.

Something cached in the login I guess. Perhaps hanging onto something related to the first cert?

Re: Error generating a new certificate

Mariano7717 — Thu, 24 Jul 2025 14:01:47 GMT

I believe found the root cause, in a way that also explains the "fixes" from everyone else.

The issue is caused by a timeout of the admin session onto the management GUI, have you ever been working through the firewalls onto the local ones or via Panorama, went to do something else, back onto the GUI and after a while things seem to not work fine, reload the page on the browser and automatically prompted with the login page to the management?

Same here, reload the page, login again, try import the same cert again, issue gone.

Explains how other people went to try on another browser and it worked straight away (because they would have to log in fresh to the mgmt)

Cheers!