Device Certificate Expired 'Invalid Request. Authentication Failed'

[aavezzano]

Hi Everybody,

I have 4 firewalls grouped into 2 HA pairs. The first pair had certificates which expired on August 18 and have failed to be renewed. The last fetched message says "Failed to renew device certificate. Invalid request. Authentication failed". I tried going through the OTP process to redeploy the certificate but under Device > Setup > Management > Device Certificate the "Get Certificate" button is no longer there. I also cannot deploy through Panorama as the devices are no longer connected (which I believe is due to the failed certificate request.

The second pair of firewalls has certificates which are expiring in a couple of days. These also have failed to renew the certificates citing the same errors.

Which authentication is failing here? I'm really not sure where to go from here to fix things. Any ideas?

Thanks for any help!

[aavezzano]

I've found the issue. I ran across the KB article here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE

Changing the MTU to 1374 fixed the issue for me.

[LCMember40912]

I tried changing the mgmt int MTU to 1374 and committed, but can't tell if it worked yet because the 'Get certificate' button is still not there!

[aavezzano]

Try running the following in CLI:

request certificate fetch

show device-certificate status

configure

commit force

[LCMember40912]

'request certificate fetch' worked to renew the cert without an OTP, but 'Get certificate' link is still not there. Doesn't seem an issue now, but still no bueno...

[billperp]

Thanks. request certificate fetch fixed it for me. I've had this error several times on a PA-460 running the latest preferred releases of firmware.

[mdelong]

Thanks for adding this command for us dude! After fixing the MTU I ran this to test it immediately and it fixed it for me! Great deets!