MANDATORY ACTION REQUIRED: Device Certificate Enforcement affects PA-440

[S.Alizada]

Hi everyone,

We have a pair of PA-440 and when we login to the dashbaord we are greeted with a notification on the Device Certificate enforcement (I have attached a screenshot of the warning).

When I have gone through the Customer advisory they clearly stated that the PA-4xx series are not affected by this enforcement.

Now we do have the following CDSS features like (Threat prevention, URL filtering, Global Protect, and More) where they all will expire on Jul 2026.

Besides there is an active and valid Device certificate in the Status Tab.

Now my questions are here:
1. is PA-440 affected by this?
2. are there any additional methods for me to confirm they are not affected as safeguard?

Thank you.

Looking forward to hearing from you.

[JayGolf]

Hi @S.Alizada ,

The notification banner you’re seeing is a generic, global message and isn’t dynamically filtered by platform type, which is why it can still appear on models like the PA-440 that are explicitly excluded from enforcement.

The PA-440 is not subject to the Device Certificate enforcement for CDSS, as it already uses the newer cert architecture with automated onboarding and renewal built into PAN-OS.

Regarding the July 2026 expiry you’re seeing... that’s related to your CDSS subscription licenses, not the device cert. License duration and expiration controls which features you can use and for how long. The device cert is used solely for secure authentication to PANW cloud services

You’ve already confirmed that you have an active and valid device cert, so you’re good to go. If you’d like an extra sanity check, you can also verify the status via CLI:

show device-certificate status

Hope this helps clarify things!