Certificates not appearing in XML running configuration

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Certificates not appearing in XML running configuration

L1 Bithead

Dear colleagues,


I am having trouble with the custom Nagios plugin check_paloalto, specifically with the "certificates" check.

The rest of the checks are working fine.


Basically, the "certificates" check leverages the API calls and parse the XML running configuration file to find the certificates. The issue is that my firewalls (which are managed by Panorama, which in turn pushes the certificates from a template) do not present the certificate part in the XML configuration file. I verified it by calling the same API in the browser.

My goal is having a Nagios check that is triggered when a certificate is near the expiration date, since we are using them for SSL Inspection and other reasons.


Panorama and firewalls are running PAN-OS 10.1.10, and Nagios is running version 5.9.3.


Is there any reason why this happens?


Many thanks!


Hi @GGarolla ,

What you are experiance is by design. Configuration pushed by Panorama is not stored in firewall local configuration, but it is stored separately as "panorama pushed" config.


I don't have access to FW right now, but there are CLI operation commands that allow you to list/view the panorama pushed config, I am sure there should be XML API call for those as well.


However in the link you shared is mentioned that  Nagios is using the Rest API (note that PAN FWs supprot XML and REST, but they are different). REST was introduced fairly recently and it has its limitations, some commands/actions are available only under XML API.

Thanks for your response, Aleksandar.

I will investigate the REST API and maybe I will try to customize the check in order to check if I can use the XML API to review the Panorama pushed configuration

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!