Failed to generate CSR Device Certificate - PA-520 -

[Bryan01]

Hello community, I encountered this error when trying to update the certificate device on a PA 520 firewall, running PAN-12.1.4-h2. Is there a known solution to this problem?

[kiwi · Accepted solution]

Hi @Bryan01 ,

I've seen similar issues when renewal is failing because the `/opt/pancfg/mgmt/ssl/private` partition storing private keys and certificates, was 100% full, preventing the generation of new CSRs and other SSL operations.

Also could be related to PAN-313623 as seen in these release notes:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-13-known-and-addresse...

I recommend reaching out to TAC to confirm you're hitting this issue.

Kind regards,

[MP18]

@Bryan01   Did you engage the TAC?

Any update on this?

Regards

[Bryan01]

Hi Kiwi, thanks for your reply. I wanted to let you know that the firewall did have a full partition issue: `/opt/pancfg/mgmt/ssl/private`. A ticket was opened with the TAC and it was recommended to update to PANOS version 12.1.4-h3. This resolved the issue. Thanks for your help.