Panorama Certificate Profile Breaks Refresh

[Eddie_Brown]

Hello Folks,

I have a strange scenario and am most likely missing something. 

I created a CA cert from a new Panorama template. I installed into the MineMeld server and verified the cert is showing up via google chrome. I then created a certificate profile and tied the CA cert to the profile.

I then created a new External Dynamic List with the certificate profile under one of my Device Groups and pushed it to a test device. The device fails on it's EDLRefresh task with the error "cert validation failed". I then proceed to remove the certificate profile from the EDL under my device group and push to my test device and the EDLRefresh task finishes successfully.

If I import the same certificate directly from my Panorama and tie it to a local certificate profile. Then create a EDL using the local certificate profile and commit the EDLRefresh job succeeds as expected.

Why is it when I push everything from my Panorama to the test device the job fails. But when I create everything local and import the exact same certificate that the pushed config is using it works?

I feel like I should be able to push the entire configuration from my Panorama to all of my devices. Seems like this is what Panorama is designed for. Is there some underlying issue with certificate profiles and Panorama I am missing?

Thanks,

Eddie

[Tim_Grossner · Accepted solution]

I had a simillar problem. I fixed mine by making sure I was setting a Subject /CN=(the IP address of the Minemeld Server) in the certificate I was creating on the Palo using the CA cert. I also added an IP certificate attribute of the MM server to the cert. I then export that cert, with the private key, and import it into MM. Then, at that point, using the cert profile that uses the CA cert to verify the cert on MM successfully.

[Tim_Grossner]

...oh, and then one more thing. In the cert profile, set the user domain to the IP address of MM that you used in the Subject CN of the cert.

[Eddie_Brown]

You sir are a scolar and a gentleman. Now to try it with the authfeeds enabled.