PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

L0 Member

I just upgraded PA-820 from PAN-OS 10.2 to 11 and when I try to access the GUI in Chrome I get the following error:

ERR_SSL_KEY_USAGE_INCOMPATIBLE

I can access an SSH command line session.

 

Suggestions on correcting this? 

1 accepted solution

Accepted Solutions

L0 Member

This is a certificate error. Resolved by following this:

Resolution

Option1:

  • If the SSL TLS profile used for management is known delete the same. This way the management access starts using the default certificate.
  • For example, The following command deletes the SSL TLS profile used for HTTPS access named profile-1

> configure
# delete deviceconfig system ssl-tls-service-profile
# delete shared ssl-tls-service-profile profile-1
# commit
# exit

​​​​​
Option2:
  1. Since SSH access is possible, a new certificate can be created from the CLI.
  2. Add the certificate to the SSL TLS profile
  3. Use the newly configured certificate and SSL profile to be used for HTTPS.

Example below:

> request certificate generate ca yes certificate-name <cert name> name <IP or FQDN> algorithm RSA rsa-nbits 2048
> configure
# set shared ssl-tls-service-profile <profile name> certificate <cert name> protocol-settings min-version tls1-0 max-version tls1-2
# set deviceconfig system ssl-tls-service-profile <profile name>
# commit
# exit

 

View solution in original post

3 REPLIES 3

L0 Member

This is a certificate error. Resolved by following this:

Resolution

Option1:

  • If the SSL TLS profile used for management is known delete the same. This way the management access starts using the default certificate.
  • For example, The following command deletes the SSL TLS profile used for HTTPS access named profile-1

> configure
# delete deviceconfig system ssl-tls-service-profile
# delete shared ssl-tls-service-profile profile-1
# commit
# exit

​​​​​
Option2:
  1. Since SSH access is possible, a new certificate can be created from the CLI.
  2. Add the certificate to the SSL TLS profile
  3. Use the newly configured certificate and SSL profile to be used for HTTPS.

Example below:

> request certificate generate ca yes certificate-name <cert name> name <IP or FQDN> algorithm RSA rsa-nbits 2048
> configure
# set shared ssl-tls-service-profile <profile name> certificate <cert name> protocol-settings min-version tls1-0 max-version tls1-2
# set deviceconfig system ssl-tls-service-profile <profile name>
# commit
# exit

 

Cyber Elite
Cyber Elite

Thank you for great sharing @ksuplicki

 

only for information Palo Alto has released an official KB for this issue: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000saCQCAY

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Official KB says it happens after upgrading to 11, but we're seeing it even with version 10!
GUI is accessible with Firefox, just not with Chrome or Edge.
Why would latest Chrome or Edge have problems with TLS 1.3 where Palo has to be told to not negotiate TLS 1.3, and why aren't the two negotiating down to the common denominator of 1.2 even if Chrome/Edge didn't support 1.3?

  • 1 accepted solution
  • 20459 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!