EDL server certificate authentication failed. A local copy of associated external dynamic list will be used

[DopedWafer]

I'm receiving this error from our firewall every 2 minutes, I can't figure out what the cause is. The reason says "self signed certificate in certificate chain" but I don't know what self signed cert it is talking about. This has been working for years now, the cert selected on the firewall is the GoDaddy root from https://certs.godaddy.com/repository/gd-class2-root.crt.

The source URL is copied our Cortex XDR settings

https://EDL-MyXDRInstance.paloaltonetworks.com/block_list?type=domain

'EDL server certificate authentication failed. A local copy of associated external dynamic list will be used, so it won\'t impact your policy. EDL Name: Cortex Domains, EDL Source URL: https://<edl>.paloaltonetworks.com/block_list?type=domain, CN: *.xdr.us.paloaltonetworks.com, Reason: self signed certificate in certificate chain

[DopedWafer]

Realizing now that it seems to have stopped at 5am CST this morning, so maybe this is resolved?

[S.Venkatesan]

On same day we also encountered this issue related to the EDL and we also using external go daddy certificate. Have you found any fix from TAC?

We reached out to TAC and trying to find the root cause.

[CosminM]

Hello,

The digital certificate presented by edl-hxdr.xdr.us.paloaltonetworks.com has a chain issue.

https://www.ssllabs.com/ssltest/analyze.html?d=edl-hxdr.xdr.us.paloaltonetworks.com

To fix that you need to download the intermediate authority certificate and to import into your firewall, then mark the imported certificate as Trust Root CA Certificate.

To help you, I already downloaded the intermediate authority certificate and you can take it from this comment. Just unzip and upload the extracted certificate to your firewall.

If you want to know more how to fix incomplete chain issues, please have a look here: Repair Incomplete Certificate Chains

[Suscripciones]

Hello @CosminM we have tried that procedure and it work it until we referenced the intermediate authority certificate into the certificate profile associated to the EDL. That was on a PA-440 without decryption.

We are trying to stop this alert on a PA-3220 with the same procedure but we still having the alert.

Has anyone fix this issue ?

[ycgmis]

We began having the same issue on our 3220. The certificate path has apparently changed. Before it was using GlobalSign. Now it's pointing to Godaddy. We have a TAC case open but the TAC doesn't seem to know what the issue is either. I've tried the suggested fixes, including the one on this thread but still no luck.

[ycgmis]

FYI, We have just identified that this issue appears to be related to the internal logging and alerting process in the firewall rather than an actual fault with the firewall successfully accessing and updating the EDL from the cortex tenant. We noticed that while we are getting email alerts for the issue every hour, (which is how often the cortex EDLs are set to update) the system logs in the firewall do not show any further alerts for this issue since July 15th. We then created a new entry into the domain EBL in cortex as testbad.com, logged into the firewall, checked the EDL and then clicked import now and the new domain showed up in the list on the firewall.

TLDR; even though we continue to get email alerts regarding Cortex EDL Sources failing to authenticate due to self signed cert, the firewall is downloading them anyway.