Certificate Expired Warning in Deploy but all certificates are good

[Stellinger]

The Sub CA Certificate of our old internal PKI expired a few days ago. It didn't have any impact and wasn't a security risk, but today i cleaned everything up.

Problem is, i still get a warning on one of our firewalls.

• Certificate %redacted% in shared expired on %redacted%

I triple checked the configuration and the new certificate i configured under Device - Certificate Management - Certificates for this Device is up and Valid.

All other firewalls are now green over the whole board, just this one throws that warning. I also checked locally on the device and it got the new certificate and everything looks right.

There could be a chance that there is a special configuration i can't see because over the years a good few admins worked on this firewall.

Any Idea what it could be before i open a support case?

Thank you!

Edit: Forgot this: Version is 10.2.7-h6 (upgrading to h18 tonight)

[JayGolf]

Hi @Stellinger ,

Try running a show configuration | match <certificate_name> in the CLI to see all the places the old cert was referenced. You can also try pulling up the config into a text editor to see where the cert is referenced as well.

[Remo]

HI @Stellinger

According to the warning, you have a multi vsys firewall where the cert is located in shared context and therefore (in theory) should be visible in all vsys. You wrote that you checked locally and the new cert is there. Sorry for the dumb question but you did look for the cert name of the expiration warning? If the configuration is pushed from panorama as far as I understood) you need to execute "show config pushed-tenplate | match <certname>" instead of "show configuration".