Configure WebGUI certificate from CLI (PanOS 9.0)

[idelconsulting]

Dear all,

lost access to the WebGUI.

opaque: websrvr: Exited 4 times, waiting 1770 seconds to retry

Before that I received another email from the firewall:

opaque: Shared certificate xxx and corresponding key have expired.

(OK, I know, my fault)

So I suspect that this is the reason for the web server failing.

All instructions I found so far talk about issuing a new self-signed certificate from the WebGUI.

How do I do that from the CLI?

request certificate generate name "paab.xyz.local" certificate-name "paabself" algorithm RSA 2048

returns

Invalid syntax

Regards,

    Andreas

[BPry · Accepted solution]

@idelconsulting 

You're just missing the rsa-nbits part of the command.

request certificate generate name "paab.xyz.local" certificate-name "paabself" algorithm RSA rsa-nbits 2048

[idelconsulting]

Thanks, wasn't really clear from the CLI TAB expansion.

I managed to get it working again by following the steps in:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC

Regards,

    Andreas

[ManFerg]

Hi, 

How impactful is this procedure?  Is it something that is safe to run during business hours?

 - Thank you