Can't find where an SSL cert is in use

[Matt_Harrell]

I'm trying to delete an SSL certificate from a Palo Alto cluster I'm setting up via Panorama.  It tells me the cert cannot be deleted due to this reason:

because of references from:

template -> {firewall cluster name} -> config -> devices -> localhost.localdomain -> vsys -> vsys1 -> captive-portal -> server-certificate

I remember messing around with Captive Portal and it did involve this certificate, but when I check the Captive Portal section of the configuration, either in Panorama, or in the primary/active firewall, there's nothing there at all.  Any thoughts on where to find this?

[tasonibare · Accepted solution]

mhar,

You might have to go into CLI to dissociate the cert from captive-portal.

1. On the primary device and/or panorama, verify that the cert is still associated with CP

> set cli config-output-format set

> configure

# show

(Use the "/set captive-portal" to search for the current captive-portal configuration on the device)

2. Delete the cert from CP

# delete captive-portal server-certificate

You should now be able to delete the certificate unless it's being referenced somewhere else

-tasonibare