Device Certificate fetch failure

[VLim]

Version : 10.1.6-h3

Issue/ Error log : Failed to fetch device certificate. Failed to send request to CSP server. Error: No OCSP response received(dest => 35.222.13.89)

Tshoot : Generated OTP over support portal but no option for me to key in the OTP

KB unable to resolve : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE&lang=en_US%E2%80%A...

Require assist on the cli to key in the otp for device certicate

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[David_Early]

I'm seeing the same thing on a PA-410 and a new eval PA-VM when trying to fetch their device certificates.

On the PA-410, it's preventing ZTP from proceeding.

It looks like an issue at Palo with api.paloaltonetworks.com.

[kiwi · Accepted solution]

Hi @VLim ,

Not sure if you've tried the following.

Once you generate the OTP on the CSP log in to your next-generation firewall as an admin user.

Select Device > Setup > Management > Device Certificate and click Get certificate.
Paste the One-time Password you generated and click OK
The firewall should successfully retrieve and install the certificate.

As for cli, is this the command you were looking for ?

admin@PA-LAB> request certificate fetch otp <value>

This will trigger the job 'Device-certificate-fetch'.

Hope this helps,

-Kiwi.

[VLim]

Seem Palo Alto take times for fetch new certificate, when I tried to execute few days later it shown success

[nkmehta]

Command is not working

[kiwi]

Hi @nkmehta ,

A bit more context would help us.  What's the outcome when you try the command ? Are you seeing an error message ?

Cheers,

-Kiwi.

[VLim]

The issues goes away by itself LOL

[rpolefka]

I have a PA440 that is throwing No Device Certificate error. Go to Device, Setup tab to try to "Get Certificate" however no option to get certificate is available:

I'm trying to do this via CLI. When I try to:

request certificate fetch otp [what-is-this-value???]

i try pasting the OTP from the website and it gives me an error.

[rpolefka]

Hmm ok well either I did something or it resolved itself. 

I did 

request certificate fetch 

and then i got

Certificate fetch job enqueued with jobid 8418

Then went back to Management page and it was there...

[PBotchway]

hello Vlim,

please this is the error im getting when trying to generate certificate 

Error

request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

[Waly]

Hello All,

I am having the same error;

request -> certificate -> fetch -> otp unexpected here
request -> certificate -> fetch is unexpected
request -> certificate is unexpected
request is unexpected

after copying the OTP from the support portal and pasting it in the get certificate

can anyone let me know how to resolve this issue?

[emr_1]

The availability of entering "otp" might be depends on your platform and version.

I'll show you two samples; one is pan-os 11.0 with PA-445, another is pan-os 10.2 with panorama.

===

admin@PA-445> show system info | match sw-version
sw-version: 11.0.2-h2
admin@PA-445>
admin@PA-445> request certificate fetch ?
<Enter> Finish input

admin@PA-445>

admin@Panorama> show system info | match sw-version
sw-version: 10.2.7
admin@Panorama>
admin@Panorama> request certificate fetch ?
* otp One time password to generate the certificatei

admin@Panorama>

===

As you can see, PA-445 does not have "otp" option.

Please check on your platform. You can check with entering "?" on your command.

[felipeorozco]

We have an issue with the Firewalls 410 and 440 due we can't execute command for get certificate. We request support to Palo Alto on a case 😞