I'm trying to setup DynDNS based on the instructions found at https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/configure-dynamic-dns-for-firew...
I'm using DuckDNS, but I'm stuck at the 'certificate profile' portion. As I understand it correctly I have to import the (public) SSL certificate of DuckDNS, but this is not provided by them.
I don't understand why this is needed since their certificate is signed by Starfield CA, which is already in the list of 'Default Trusted Certificate Authorities' on the Paloalto firewall.
Also other DynDNS provides such as DYN don't seem to provide their public certificates for download.
Solved! Go to Solution.
The public cert is always public available. It is send in every tls connection that you establish to duckDNS. In your browser you can see the cert also when you check the tls certificate of the website.
The duckDNS cert is this one here:
But for the cert profile you should use the intermediate cert which signed the duckdns cert.
Hope this helps.
The Duckdns.org cert is signed by Starfield Secure CA GW, so I tried to import the Root G2 and intermediate G2 certificate found on http://certs.starfieldtech.com/repository/
But I still see the following error in the system log when filtering ddns type entries: Server response: 'Peer certificate cannot be authenticated with given CA certificates'
I've got it running now.
The root certificate was already installed, but I had to import a different intermediate bundle: https://ssl-ccp.secureserver.net/repository/sf_bundle-g2-g1.crt
I've been having the same issue with DuckDNS DDNS via the Palo Alto and finally got it to work after what seems like hours of downloading certificates from Starfield and trying different combinations... as this was the only post I've been able to find with anything relevant I thought I would add what finally worked for me.
I tried multiple different combinations of intermediate certificates and adjusting other settings.
What finally worked was using Firefox, going to www.duckdns.org, opening the SSL certificate properties and exporting the root certificate and each of the intermediate certificates down the chain in order (I numbered the three of them for simplicity.) I then cleared out other test certificates, imported them in order one by one setting the very top one as a Trusted root CA - but not setting any of the intermediates as trusted root CAs and I did not import the DuckDNS certificate itself. I then created a new Certificate Profile and added each of the certificates to the profile in order, set the Certificate Profile that I created in the dynamic DNS profile and saved it.
Low and behold a test "dns-proxy ddns update interface name vlan" in the CLI finally worked, when I checked the logs under Monitor -> Logs -> System -> ( subtype eq ddns )
For reference, the Advanced -> DDNS -> Hostname entry was set as the DDNS hostname *without* the .duckdns.org appended. API Host at www.duckdns.org, Base URI at /update, Secret Token pasted in with no spaces or other characters (generally the default DuckDNS v1 settings with my own private key.
Hopefully that saves someone some of the same headaches - seems strange that these aren't trusted by default with OEM provided Certificate Profiles for each service in the OEM provided DDNS profiles.
Thanks a lot @MichaelJay you saved me a huge headaches on my no-ip dyndns situation... I was about to throw my Palo by the windows. Now need to understand why my GP portal wont pop up ... if you have any insight would be nice
Vincent, very glad to hear that it worked, I wasted way too many hours trying assorted settings!
As far as the GP portal popup, I would probably suggest opening a new conversation on topic and giving a lot more detail on what you're having trouble with. I'm not sure what you mean exactly... As far as the GP VPN client which connects to the portal and then the gateway to establish the VPN, we had to make sure a single certificate was issued to each machine from our CA and trusted by the Palo, and remove all duplicate certificates from the clients. There is a setting to enable prompting for authentication, if it's disabled it won't pop-up an authentication request and will only try to do single sign-on authentication. For SSO you need to make sure that you are signing in to the workstation with the GP "credential provider" in windows (should be a globe icon under "more options" before you login, and only shows up after GP is installed.) We also had issues with pre-logon split tunnel settings not refreshing to per user split tunnels - so had to duplicate the settings to make it work. This was a fairly involved setup with a lot of moving parts and multiple TAC calls to iron things out. If you mean some other aspect, I don't have any tips off hand. Hopefully you get it figured out easily.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!