Master Key extending time issue

[TranceforLife]

Hi All Experts,

I am currently having an issue while attempting to extend a Master Key validity time:

2017-07-21 00:08:20.473 +0100 ------------ Received event:3 (Cfg installed) in worker thread ------------

2017-07-21 00:08:20.475 +0100 [3] Reading mkey, ks files...

2017-07-21 00:08:20.475 +0100 [3] Get fips/cc mode, event_type

2017-07-21 00:08:20.482 +0100 [3] Begin to read master keys into mkobj

2017-07-21 00:08:20.483 +0100 Reading /opt/pancfg/.keystore/mkey.xml file into sysd dict

2017-07-21 00:08:20.484 +0100 [3] Read keystore file into cryptod_keystore dict

2017-07-21 00:08:20.484 +0100 Reading /opt/pancfg/.keystore/ks.xml file into sysd dict

2017-07-21 00:08:20.485 +0100 -- Reading startup keys files from disk, query:0 --

2017-07-21 00:08:20.485 +0100 -- Done reading and deleting 0 startup keys files from disk --

2017-07-21 00:08:20.486 +0100 [3] Done reading mkey and keystore files

2017-07-21 00:08:20.486 +0100 Mkey expiry timer stopped

2017-07-21 00:08:20.486 +0100 Mkey reminder timer stopped

2017-07-21 00:08:20.486 +0100 Starting reminder ager for mkey for 1590447 seconds from now

2017-07-21 00:08:20.486 +0100 Starting expiry ager for mkey for 4182447 seconds from now

2017-07-21 00:10:15.243 +0100 Error:  pan_cryptod_sysd_decr_recv_cb(pan_cryptod_crypt.c:1571): Decryption failed, abort

Thanks to All,

pinging: @reaper @Remo @BPry

[Remo]

@TranceforLife

Good question 😛

What character set did you you use for the new key? May be you used a character that is "not supported" --> bug

Did you try with only alphanumeric characters?

[TranceforLife]

Hi @Remo,

Thanks for your feedback. l have followed this guide:

https://live.paloaltonetworks.com/t5/Management-Articles/Character-Limitation-for-Setting-Up-Master-...

I can see it is complaining about some private SSL cert key, but not sure why!!!!

[Remo]

Hi @TranceforLife

Sorry for asking again ... Just to make sure that it is not related to a bug with a special character, you tried with something as easy (without special characters) as "password12345678"?

[TranceforLife]

Exactly simple password, it is something to do with the private key of the ssl cert. Maybe it needs to re-upload. Not sure ( 

[Remo]

@TranceforLife

PAN-79780? --> fixed in 8.0.4

[TranceforLife · Accepted solution]

Hi @Remo,

Thanks. This is now with TAC and l think we are looking into the "wrong master key" scenario. Yes, l know ...... So current key most likely is not valid (wrong key). Don't ask me how it happened :D, but a workaround is quite tedious (reset the device to its default and re-type all config PASSWORDS manually).

[TranceforLife]

Indeed the wrong MK.