Fetch Device Certificate failure

[Meed]

Hello,

I am getting this error (Failed to fetch device certificate.TPM public key match failed.) on a PA460 (11.0.2-h2).

I tried multiple solutions without success :

• This KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE but it didn't work.
• Multiple commit force.
• I even generated an OTP on the CSP but I don't have the get certificate button on the web interface and can't use it on the CLI, I get invalid syntax after request certificate fetch OPT_value.

I can ping certificate.paloaltonetworks.com form the management interface.

Kindly help to resolve the issue.

[PravinSingi]

Getting the same error on 440 too..

[Tobi]

We have the same error with our new PA-3410 and PAN-OS 10.2.6.

I am going to open a case...

[Meed]

PaloAlto solved the problem for me by deleting the existing certificate and generating a new one. It needed root access to the firewall.

[PravinSingi]

Thanks, @Meed. I will reach out to PAN support.

[Tobi]

Palo Alto also saved it for me. They updated the claim key and Hash Key from their end. After a "commit force" the issue was fixed.

[luis56]

Encountering a "Fetch Device Certificate" failure may result from various issues. Ensure network connectivity, valid credentials, and proper certificate configuration. Troubleshoot systematically, collaborating with support if needed. A comprehensive approach ensures efficient resolution, maintaining secure and seamless device communication.

[msyeedrafiqi]

It will require a maintenance  window you  can follow the below Steps and let me know if it works:

1.Log in to cli
2. Configure  
3. Commit force
4.exit
And see if it works and if you are still getting the same error

[david.ge]

how to delete the existing certificate,?

how to use root access? 

[armitchell]

This worked for me. I was trying to download device certificate using the web gui but was getting unexpected otp.