EDL server certificate authentication failed. A local copy of associated external dynamic list will be used

[DopedWafer]

Since Saturday 7/12/2026 I've started receiving these messages on our firewall every few minutes.

eventid: tls-edl-auth-failure
object:
fmt: 0
id: 0
module: general
severity: critical
opaque: EDL server certificate authentication failed. A local copy of associated external dynamic list will be used, so it won't impact your policy. EDL Name: Cortex IPs, EDL Source URL: https://edl-OurSite.xdr.us.paloaltonetworks.com/block_list?type=ip, CN: *.xdr.us.paloaltonetworks.com, Reason: self signed certificate in certificate chain

I'm not sure where to begin troubleshooting. I've verified the edl username and password, as well as the url is all correct on our firewall.

The error obviously makes it sound like an issue with the certificate but I'm not aware of this being something we control

Firewall is currently on 11.1.13 

[TomYoung · Accepted solution]

Hi @DopedWafer ,

Those errors normally mean that you have a Certificate Profile configured inside your EDL AND the web site has changed its certificate.  Your "Reason: self signed certificate in certificate chain" seems to indicate that the certificate for the URL has been replaced with a self-signed certificate.  You should browse to the URL; verify the certificates; and update your Certificate Profile to make sure the certificate chain matches.

Thanks,

Tom

[DopedWafer]

Originally I followed the guide here https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Manage-external-d... which has me download a godaddy root cert and that did not work. But with your suggestion I went to my URL and exported the digicert certificates and uploaded to the firewall. I then changed the EDL cert to that and the errors have gone away.

Thank you