Enterprise PKI Cert Chain Error

[rjdahav163]

Hello 

we have our enterprise CA and our PA firewalls have signed certs from it. Now for our captive portal, we also have a certi signed from our enterprise CA. Everything works and there is no browser error for certificate.

But in the FW commit, we get a warning "Warning: cannot find complete certificate chain for certificate ..."

I found the following KB for a Public CA

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed...

and I also tried the Workaround mentioned at the bottom of the KB, but it does not work.

Any suggestions?

Thanks and Regards,

R

[bmorris1]

Hi @rjdahav163

My advice would be to take a look at the certificate hierarchy in Windows, are you seeing the full chain there that is expected when you open up the file?

Example here, taken from the live community website:

hope this helps,

Ben

[rjdahav163]

Hi @bmorris1

Yes I see the complete chain in the hierarchy as expected and installed the same on FW but still firewall complains. 😞

Regards,

R