API error messages

[s0lselcia]

Hi all

This error message keeps coming up:

The latest API KeyGen was executed on <date and time> with the deprecated algorithm. You are advised to configure the more secure API key infrastructure by web interface: Setup -> Management -> Authentiation Settings -> API Key Certificate, or by CLI: set deviceconfig setting management api key certificate

API certificate is not even set up.

This has happened over 100 times in the system logs. Can this error be stopped and how will it affect the admin users?

[mghazzi · Accepted solution]

I fixed it on sw-version: 11.2.10 like this.. (7300 is the max allowed number of days - 20yrs), enjoy:

> request certificate generate ca yes days-till-expiry 7300 algorithm RSA rsa-nbits 4096 certificate-name API-test name API-test

> configure
# set deviceconfig setting management api key certificate API-test
# commit

[mghazzi]

It is not complaining about the presence or absence of the API Key, but rather the certificate to be used by the API-key, you don't need to configure an API-key to get rid of the error, you just need to choose/create a cert to be used by the API-key should you ever configure the API key. Basically, for your security, Palo is getting out of the business of providing factory created certs, and now they want the user to generate certs locally or provide them via CA, but factory-provided certs have become a liability for obvious reasons.