Certificate failed to load

[vesna.djukic]

Hi all,

We have two PA-4060 in active/passive mode with PAN-OS 4.1.12 (I know, old..).

Yesterday, after rebooting passive device auto commit failed with:

Error: Certificate 'XYZ' failed to load: failed to parse key

and device went to not-ready state.

After deleting problematic certificate and with commit force device become functional again.

We then tried synchronize configurations manually but HA-Sync fail with the same error

Error: Certificate 'XYZ' failed to load: failed to parse key

The last time the device was rebooted in March 2014 without problems and with the now problematic certificate on it.

Does anyone have any solution why this error occurred?

Tnx and regards,

Vesna.

[Tijl]

Hi Vesna,

1. upgrade

2. It looks like your certificate isn't supported: What's the key size and signature algorithm of the certificate?

What is the certificate used for on your PA?

-> try to use a certificate that has the same options as the ones you get when creating a certificate on the PA itself.

Regards,

Tijl

[Kevin.lane]

We are actually seeing similar behaviour on Pan 6.1.2 on our PA-3020's. We try to sync from the primary to the secondary and it fails with that same error.  It has caused us no end of problems because effectively, the only way for us to get the sync to work is remove the global protect configuration which makes use of the certificates and then delete the certificates.  I'm wondering if anyone else has seen this and has an idea of why it may be happening?

[vesna.djukic]

Tijl, thank you for answer. Yes, I agree that upgrade is a must.

According to the information I received from the user, signature algorithm is SHA1RSA and public key size is 2048.

It's funny that this error didn't not occur last time device was rebooted and it is mystery why did it happened this time.

[Tijl]

smells like a bug