Cert Delete and Created new devicecert

[Gun-Slinger]

Anyone run into this?

We discovered around 0400 AM (outside business hours so no admins online) the following logs generated. They appear system generated as if the device is regenerating a cert. Problem is, it doesn't match the dates on the device certificate that is normally generated under the device tab and PAN has zero documentation to tell us if this is normal behavior.

[SCantwell_IM]

Hello, this is normal to see a device cert get regenerated. It will do this every 90 days more or less.

[Gun-Slinger · Accepted solution]

We contacted TAC to get clarity on this issue and here is the answer received:

This is a new feature in 10.1.

The firewall certificate is valid for 3 Months.

2 Weeks prior to expiration, the firewall will:
     -Create a new CSR and send this to panorama for signing
     -Panorama will sign this CSR and return, signed cert, device CA cert, SNI to use for this new certificate
     -Switches the connection to new Cert on the next connect

[Puvi12]

We're noticing similar issue on Panorama where there is no certificate creation however getting the high severity alert on the cert delete.

is there anyway to stop this high severity cert delete alert?