Device Certificate fetch failure

[VLim]

Version : 10.1.6-h3

Issue/ Error log : Failed to fetch device certificate. Failed to send request to CSP server. Error: No OCSP response received(dest => 35.222.13.89)

Tshoot : Generated OTP over support portal but no option for me to key in the OTP

KB unable to resolve : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE&lang=en_US%E2%80%A...

Require assist on the cli to key in the otp for device certicate

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[David_Early]

I'm seeing the same thing on a PA-410 and a new eval PA-VM when trying to fetch their device certificates.

On the PA-410, it's preventing ZTP from proceeding.

It looks like an issue at Palo with api.paloaltonetworks.com.

[kiwi · Accepted solution]

Hi @VLim ,

Not sure if you've tried the following.

Once you generate the OTP on the CSP log in to your next-generation firewall as an admin user.

Select Device > Setup > Management > Device Certificate and click Get certificate.
Paste the One-time Password you generated and click OK
The firewall should successfully retrieve and install the certificate.

As for cli, is this the command you were looking for ?

admin@PA-LAB> request certificate fetch otp <value>

This will trigger the job 'Device-certificate-fetch'.

Hope this helps,

-Kiwi.

[VLim]

Seem Palo Alto take times for fetch new certificate, when I tried to execute few days later it shown success

[nkmehta]

Command is not working

[kiwi]

Hi @nkmehta ,

A bit more context would help us.  What's the outcome when you try the command ? Are you seeing an error message ?

Cheers,

-Kiwi.

[VLim]

The issues goes away by itself LOL

[rpolefka]

I have a PA440 that is throwing No Device Certificate error. Go to Device, Setup tab to try to "Get Certificate" however no option to get certificate is available:

I'm trying to do this via CLI. When I try to:

request certificate fetch otp [what-is-this-value???]

i try pasting the OTP from the website and it gives me an error.

[rpolefka]

Hmm ok well either I did something or it resolved itself. 

I did 

request certificate fetch 

and then i got

Certificate fetch job enqueued with jobid 8418

Then went back to Management page and it was there...