Failed to renew device certificate

[kbe]

Hi

the device certificate is going to expire end of march.

My PA trys to renew it and comes up with the following error:

Failed to renew device certificate.Failed to send request to CSP server.Error: No OCSP response received(dest => 35.238.43.180)

I have no telemetry enabled.

Just activated the certificate with OTP on 2020/12/29 after upgrading to PanOS 9.1.7.

Now it´s the first try of my PA to renew it.

The only thing i found relates to PanOS 9.1.8 wich seems to fix another error with device certificate:

Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP): 

invalid ocsp response sig-alg

Any ideas where to look for?

TIA

[Jason_Lieberman]

I have no such link.

[kiwi]

Hi @Jason_Lieberman ,

There's a way to fetch it using the CLI:

admin@PA-LAB> request certificate fetch otp <value>

replace <value> with the OTP generated on the support portal.

Hope this helps,

-Kiwi.

[Jason_Lieberman]

While the 'request certificate fetch otp' is not a valid command on my 440.  'request certificate fetch' is.  When I ran that is managed to get a new cert.  I'm shocked!  It's been failing for a few weeks now and TAC is stumped as to why.

Thank you for that.

[niavasha]

Try the solution here on the 440 - it works luckily : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE

[niavasha]

Then ssh in and try simply:

 request certificate fetch