PAN-OS Certificate Expiration on Dec 31 2023

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

PAN-OS Certificate Expiration on Dec 31 2023

L0 Member

Hello, we have this error message when launching palo alto:

 

"Urgent Action required: PAN-OS Certificate Expiration on Dec 31 2023. For details, refer to the following Customer Advisory:

https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-d..."

 
When I click on the url, a page is displayed with access denied,

 

What actions should I take? , what is the level of emergency? , will my firewall still work in January?
 
 
My Firewall PaloAlto is :  PA-3020
 
Sofware Version : 9.1.14-h1
 
Thank you for your help

 

 

1 accepted solution

Accepted Solutions

Hi @CERMAV-SI ,

Small clarification - this is not an error message, but rather critical notification. Those notifications are distributed from Palo Alto update cloud when important information needs to be share with end-customers.

 

It looks like you are trying to access the page from account that is not associated with any support portal accounts. Try to open the link with account that exist in your support portal.

 

 

Below I will share that I believe is most important:

 

 

On December 31, 2023, the root certificate and default certificate for Palo Alto Networks firewalls and appliances running PAN-OS software will expire. If you do not renew your certificates before they expire, your firewalls and Panorama appliances will no longer establish new connections to Palo Alto Networks cloud services, which will impact network traffic and potentially cause a network outage when existing connections terminate and attempt to reconnect due to network changes, configuration changes, or unforeseen events.

 

Target Upgrade Versions

The table below contains the target upgrade versions for both scenario 1a and scenario 2b.

 

Current PAN-OS Version

Upgrade Target Version

9.1

9.1.11-h4

9.1.12-h6

9.1.13-h4

9.1.14-h7

9.1.16-h3 

9.1.17 or greater

 

Scenario 1

If you are a customer with Data redistribution (User-ID, IP-tag, User-tag, GlobalProtect HIP, and/or quarantine list) you will need to take one of the following two actions: (1a) upgrade your affected firewalls, and Panorama (Management and Log Collector modes), OR (1b) deploy Custom Certificates to your affected firewalls, and Panorama (Management and Log Collector modes).


Scenario 2

If you are a customer with WildFire public cloud, Advanced WildFire public cloud, URL Filtering, Advanced URL Filtering, DNS Security, Threat Vault, or AutoFocus, you must perform one of the following three actions before your certificates expire on December 31, 2023: (2a) install a specific content update on your impacted firewalls and Panorama appliances OR (2b) upgrade your impacted firewalls and Panorama appliances OR (2c) enable device certificates on your impacted firewalls and Panorama appliances.





View solution in original post

6 REPLIES 6

Hi @CERMAV-SI ,

Small clarification - this is not an error message, but rather critical notification. Those notifications are distributed from Palo Alto update cloud when important information needs to be share with end-customers.

 

It looks like you are trying to access the page from account that is not associated with any support portal accounts. Try to open the link with account that exist in your support portal.

 

 

Below I will share that I believe is most important:

 

 

On December 31, 2023, the root certificate and default certificate for Palo Alto Networks firewalls and appliances running PAN-OS software will expire. If you do not renew your certificates before they expire, your firewalls and Panorama appliances will no longer establish new connections to Palo Alto Networks cloud services, which will impact network traffic and potentially cause a network outage when existing connections terminate and attempt to reconnect due to network changes, configuration changes, or unforeseen events.

 

Target Upgrade Versions

The table below contains the target upgrade versions for both scenario 1a and scenario 2b.

 

Current PAN-OS Version

Upgrade Target Version

9.1

9.1.11-h4

9.1.12-h6

9.1.13-h4

9.1.14-h7

9.1.16-h3 

9.1.17 or greater

 

Scenario 1

If you are a customer with Data redistribution (User-ID, IP-tag, User-tag, GlobalProtect HIP, and/or quarantine list) you will need to take one of the following two actions: (1a) upgrade your affected firewalls, and Panorama (Management and Log Collector modes), OR (1b) deploy Custom Certificates to your affected firewalls, and Panorama (Management and Log Collector modes).


Scenario 2

If you are a customer with WildFire public cloud, Advanced WildFire public cloud, URL Filtering, Advanced URL Filtering, DNS Security, Threat Vault, or AutoFocus, you must perform one of the following three actions before your certificates expire on December 31, 2023: (2a) install a specific content update on your impacted firewalls and Panorama appliances OR (2b) upgrade your impacted firewalls and Panorama appliances OR (2c) enable device certificates on your impacted firewalls and Panorama appliances.





L0 Member

What will be the date of expiration of the version we are upgrading to? 
Say from 9.1.13h3 to 9.1.13h4

L0 Member

Hello,

I'm coming back to you regarding our alert message.

We no longer have support on our device for 6 months.

My Firewall PaloAlto is :  PA-3020 ( EOS October 31, 2024)

How to download and upgrade our device?

we can't find the version 9.1.14-h7 on the internet.

Currently, we have the version 9.1.14-h1 installed.

 

Thanks for your help

 

 

 

L4 Transporter

If i have a firewal connected to a UIA (W2018 server). That means i have redistribution scenario 1? or this is only if my FW is doing redistribution to another FWs?

L0 Member

Hola esta notificacion a que se refiere

 

Confidential Information - For Intended Recipient's Internal Use Only

 

Dear Valued Palo Alto Networks customer,

 

If you have a Palo Alto Networks next-generation firewall (NGFW),  Panorama for NGFW management, or any of the following security services, WildFire,  Advanced WildFire Public Cloud, WildFire Private Cloud, DNS Security, URL Filtering, URL PAN-DB Private Cloud, and User-ID or Terminal Server agents, this update impacts you. This update is a follow-up to the November advisory and describes our comprehensive certificate management plan.

 

Please note: additional actions are required even if you upgraded your software versions as part of the November 2023 advisory

 

Please complete all actions described in the “Additional PAN-OS Certificate Advisory” before April 7, 2024.  Upon completing the actions described below, no further certificate updates are needed until December 31, 2026. For additional information on our longer-term certificate management strategy, please review the advisory.

 

Regards,

Customer Support

Palo Alto Networks

L0 Member

Hello everyone,

In my company a FW has been left without upgrading to any of the recommended versions. Now when I try to update it I get the following error:

 

Is there any way to update the FW to the recommended version? We already tried to download the image and load it manually on the computer but the error is the same.

 

We have opened a case with TAC but have not received a response yet.

 

I would appreciate some help

  • 1 accepted solution
  • 21451 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!