For details on cookie usage on our site, read our Privacy Policy
EDL - unable to get local issuer certificate
- LIVEcommunity
- Discussions
- Network Security
- Next-Generation Firewall Discussions
- EDL - unable to get local issuer certificate
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-02-2023 11:56 AM
Hi,
Having issues with EDL and certificates. Followed the best practices, and believe everything is set properly.
running pa-8xx clusters running 10.1.9h3, all have the same issue
opendbl.net cert chain is imported and set both root and intermediate in the cert profile. opendbl EDL created, cert profile attached and outbound policy applied.
Anyone run into the following errors? Thanks for any advice.
Example from system monitor logs:
EDL server certificate authentication failed. A local copy of associated external dynamic list will be used, so it won't impact your policy. EDL Name: Blocklist.de All, EDL Source URL: https://opendbl.net/lists/blocklistde-all.list, CN: opendbl.net, Reason: unable to get local issuer certificate
EDL(Blocklist.de All) No changes to authentication status, still failing.
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-04-2023 02:53 PM
Hello,
I would say bypass decryption for those url's.
Regards,
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-05-2023 07:13 AM
Hi,
Thanks, tested and works without using cert. Couldn't find a solution that works with cert, so will just continue using http only.
Regards
- Global Protect Mac OS in GlobalProtect Discussions
- Site to Site RSA_verify failed , error rsa routines (PaloAlto to checkpoint SMB) in Next-Generation Firewall Discussions
- Errors - ROOT CA authority untrusted / invalid in VM-Series in the Private Cloud
- Mac Users getting connection failed unable to verify certificate in GlobalProtect Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
