PA-820 PAN-OS 10.2 upgrade to 11, ERR_SSL_KEY_USAGE_INCOMPATIBLE unable to access GUI with Chrome

[ksuplicki]

I just upgraded PA-820 from PAN-OS 10.2 to 11 and when I try to access the GUI in Chrome I get the following error:

ERR_SSL_KEY_USAGE_INCOMPATIBLE

I can access an SSH command line session.

Suggestions on correcting this? 

[ksuplicki · Accepted solution]

This is a certificate error. Resolved by following this:

Resolution

Option1:

• If the SSL TLS profile used for management is known delete the same. This way the management access starts using the default certificate.
• For example, The following command deletes the SSL TLS profile used for HTTPS access named profile-1

> configure
# delete deviceconfig system ssl-tls-service-profile
# delete shared ssl-tls-service-profile profile-1
# commit
# exit

​​​​​
Option2:

1. Since SSH access is possible, a new certificate can be created from the CLI.
2. Add the certificate to the SSL TLS profile
3. Use the newly configured certificate and SSL profile to be used for HTTPS.

Example below:

> request certificate generate ca yes certificate-name <cert name> name <IP or FQDN> algorithm RSA rsa-nbits 2048
> configure
# set shared ssl-tls-service-profile <profile name> certificate <cert name> protocol-settings min-version tls1-0 max-version tls1-2
# set deviceconfig system ssl-tls-service-profile <profile name>
# commit
# exit

[PavelK]

Thank you for great sharing @ksuplicki

only for information Palo Alto has released an official KB for this issue: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000saCQCAY

Kind Regards

Pavel

[Dan_Morin]

Official KB says it happens after upgrading to 11, but we're seeing it even with version 10!
GUI is accessible with Firefox, just not with Chrome or Edge.
Why would latest Chrome or Edge have problems with TLS 1.3 where Palo has to be told to not negotiate TLS 1.3, and why aren't the two negotiating down to the common denominator of 1.2 even if Chrome/Edge didn't support 1.3?