Device Certificate fetch failure

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Device Certificate fetch failure

L2 Linker

Version : 10.1.6-h3

Issue/ Error log : Failed to fetch device certificate. Failed to send request to CSP server. Error: No OCSP response received(dest => 35.222.13.89)

Tshoot : Generated OTP over support portal but no option for me to key in the OTP

 

KB unable to resolve : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE&lang=en_US%E2%80%A...

 

Require assist on the cli to key in the otp for device certicate

 



Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.
1 accepted solution

Accepted Solutions

Community Team Member

Hi @VLim ,

 

Not sure if you've tried the following.

Once you generate the OTP on the CSP log in to your next-generation firewall as an admin user.

Select Device > Setup > Management > Device Certificate and click Get certificate.
Paste the One-time Password you generated and click OK
The firewall should successfully retrieve and install the certificate.

 

As for cli, is this the command you were looking for ?

 

admin@PA-LAB> request certificate fetch otp <value>

 

This will trigger the job 'Device-certificate-fetch'.

 

Hope this helps,

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

View solution in original post

12 REPLIES 12

L0 Member

I'm seeing the same thing on a PA-410 and a new eval PA-VM when trying to fetch their device certificates.

On the PA-410, it's preventing ZTP from proceeding.

 

It looks like an issue at Palo with api.paloaltonetworks.com.

Community Team Member

Hi @VLim ,

 

Not sure if you've tried the following.

Once you generate the OTP on the CSP log in to your next-generation firewall as an admin user.

Select Device > Setup > Management > Device Certificate and click Get certificate.
Paste the One-time Password you generated and click OK
The firewall should successfully retrieve and install the certificate.

 

As for cli, is this the command you were looking for ?

 

admin@PA-LAB> request certificate fetch otp <value>

 

This will trigger the job 'Device-certificate-fetch'.

 

Hope this helps,

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Seem Palo Alto take times for fetch new certificate, when I tried to execute few days later it shown success

Command is not working

Community Team Member

Hi @nkmehta ,

 

A bit more context would help us.  What's the outcome when you try the command ? Are you seeing an error message ?

 

Cheers,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

The issues goes away by itself LOL

L0 Member

I have a PA440 that is throwing No Device Certificate error. Go to Device, Setup tab to try to "Get Certificate" however no option to get certificate is available:

 

no-cert.png

 

I'm trying to do this via CLI. When I try to:


request certificate fetch otp [what-is-this-value???]

 

i try pasting the OTP from the website and it gives me an error.

 

Hmm ok well either I did something or it resolved itself. 


I did 

request certificate fetch 

and then i got

Certificate fetch job enqueued with jobid 8418

 

Then went back to Management page and it was there...

no-cert.png

 

hello Vlim,

please this is the error im getting when trying to generate certificate 

 
Error
 
request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

Hello All,

 

I am having the same error;

 

request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

 

after copying the OTP from the support portal and pasting it in the get certificate

 

can anyone let me know how to resolve this issue?

L5 Sessionator

The availability of entering "otp" might be depends on your platform and version.

I'll show you two samples; one is pan-os 11.0 with PA-445, another is pan-os 10.2 with panorama.

===

admin@PA-445> show system info | match sw-version
sw-version: 11.0.2-h2
admin@PA-445>
admin@PA-445> request certificate fetch ?
<Enter> Finish input

admin@PA-445>

 

admin@Panorama> show system info | match sw-version
sw-version: 10.2.7
admin@Panorama>
admin@Panorama> request certificate fetch ?
* otp One time password to generate the certificatei

admin@Panorama>

===

 

As you can see, PA-445 does not have "otp" option.

Please check on your platform. You can check with entering "?" on your command.

 

 

 
  • 1 accepted solution
  • 16733 Views
  • 12 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!