I can't perform a dynamic update on the PA-460

[D.Watanabe454116]

Hi,
When I ran “Device > Dynamic Updates > Check Now” on the PA-460, the following error was displayed.

Failed to check Content upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again. Failed to check IoT upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again. Failed to check Antivirus upgrade information due to an invalid SSL peer certificate or SSH remote key. Please check network connectivity and try again.

The device information is as follows:
・PAN-OS: 12.1.6
・DNS server: 8.8.8.8
・Proxy server: None
・Management plane has been restarted
* >debug software restart process management-server
・Can connect to updates.paloaltonetworks.com
・The latest version of the “Applications and Threats” signature has been installed (July 7, 2026)
・Confirmed that dynamic updates are possible when the checkbox for “Verify Update Server ID” under Device > Services is unchecked
・Error log under Device > System

■description contains 'Failed to check Antivirus content upgrade info due to SSL peer certificate or SSH remote key was not OK
■description contains ‘Failed to check Content upgrade info due to SSL peer certificate or SSH remote key not being OK’
■description contains ‘Failed to check IoT content upgrade info due to SSL peer certificate or SSH remote key not being OK’

Could you please provide any information regarding a solution?

Best regards,
Daisuke

[kiwi]

Hi @D.Watanabe454116 ,

Sounds like you might be running into a known issue where hashed symlinks to predefined CA certificates may be missing.

As a result, this prevents from verifying the update server certificate chain even though the certificate exists in the store.

To resolve this issue, one must rebuild the hashed symlinks for all predefined trusted root CAs from the root shell (TAC only).

I've seen scenarios where upgrading the PAN-OS version also fixed this.

Please reach out to TAC in order to confirm you're hitting this exact issue.

Kind regards,