PAN-OS Certificate Expiration on Dec 31 2023

[CERMAV-SI]

Hello, we have this error message when launching palo alto:

"Urgent Action required: PAN-OS Certificate Expiration on Dec 31 2023. For details, refer to the following Customer Advisory:

https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-d..."

When I click on the url, a page is displayed with access denied,

What actions should I take? , what is the level of emergency? , will my firewall still work in January?

My Firewall PaloAlto is :  PA-3020

Sofware Version : 9.1.14-h1

Thank you for your help

[aleksandar.astardzhiev · Accepted solution]

Hi @CERMAV-SI ,

Small clarification - this is not an error message, but rather critical notification. Those notifications are distributed from Palo Alto update cloud when important information needs to be share with end-customers.

It looks like you are trying to access the page from account that is not associated with any support portal accounts. Try to open the link with account that exist in your support portal.

Below I will share that I believe is most important:

On December 31, 2023, the root certificate and default certificate for Palo Alto Networks firewalls and appliances running PAN-OS software will expire. If you do not renew your certificates before they expire, your firewalls and Panorama appliances will no longer establish new connections to Palo Alto Networks cloud services, which will impact network traffic and potentially cause a network outage when existing connections terminate and attempt to reconnect due to network changes, configuration changes, or unforeseen events.

Target Upgrade Versions

The table below contains the target upgrade versions for both scenario 1a and scenario 2b.

Current PAN-OS Version	Upgrade Target Version
9.1	9.1.11-h4 9.1.12-h6 9.1.13-h4 9.1.14-h7 9.1.16-h3  9.1.17 or greater

Scenario 1

If you are a customer with Data redistribution (User-ID, IP-tag, User-tag, GlobalProtect HIP, and/or quarantine list) you will need to take one of the following two actions: (1a) upgrade your affected firewalls, and Panorama (Management and Log Collector modes), OR (1b) deploy Custom Certificates to your affected firewalls, and Panorama (Management and Log Collector modes).

Scenario 2

If you are a customer with WildFire public cloud, Advanced WildFire public cloud, URL Filtering, Advanced URL Filtering, DNS Security, Threat Vault, or AutoFocus, you must perform one of the following three actions before your certificates expire on December 31, 2023: (2a) install a specific content update on your impacted firewalls and Panorama appliances OR (2b) upgrade your impacted firewalls and Panorama appliances OR (2c) enable device certificates on your impacted firewalls and Panorama appliances.

[rajansoni56]

What will be the date of expiration of the version we are upgrading to? 
Say from 9.1.13h3 to 9.1.13h4

[CERMAV-SI]

Hello,

I'm coming back to you regarding our alert message.

We no longer have support on our device for 6 months.

My Firewall PaloAlto is :  PA-3020 ( EOS October 31, 2024)

How to download and upgrade our device?

we can't find the version 9.1.14-h7 on the internet.

Currently, we have the version 9.1.14-h1 installed.

Thanks for your help

[BigPalo]

If i have a firewal connected to a UIA (W2018 server). That means i have redistribution scenario 1? or this is only if my FW is doing redistribution to another FWs?

[ESTTYWARD]

Hola esta notificacion a que se refiere

Confidential Information - For Intended Recipient's Internal Use Only

Dear Valued Palo Alto Networks customer,

If you have a Palo Alto Networks next-generation firewall (NGFW),  Panorama for NGFW management, or any of the following security services, WildFire,  Advanced WildFire Public Cloud, WildFire Private Cloud, DNS Security, URL Filtering, URL PAN-DB Private Cloud, and User-ID or Terminal Server agents, this update impacts you. This update is a follow-up to the November advisory and describes our comprehensive certificate management plan.

Please note: additional actions are required even if you upgraded your software versions as part of the November 2023 advisory. 

Please complete all actions described in the “Additional PAN-OS Certificate Advisory” before April 7, 2024.  Upon completing the actions described below, no further certificate updates are needed until December 31, 2026. For additional information on our longer-term certificate management strategy, please review the advisory.

Regards,

Customer Support

Palo Alto Networks

[SSuarez2023]

Hello everyone,

In my company a FW has been left without upgrading to any of the recommended versions. Now when I try to update it I get the following error:

Is there any way to update the FW to the recommended version? We already tried to download the image and load it manually on the computer but the error is the same.

We have opened a case with TAC but have not received a response yet.

I would appreciate some help