Urgent action required: PAN-OS certificate expiration advisory

[kdamodaran]

I recommend reviewing the customer advisory linked above in detail in order to understand the next steps and applicability. Essentially, the root and default certificate on PAN-OS will expire on December 31, 2023 - if not renewed before that date, this will result in firewalls and/or Panorama losing connectivity to our cloud services as well as between each other when data redistribution (User-ID, Tags, etc.) is configured, potentially causing an impact to network traffic.

All of our Palo Alto firewalls and Panorama running in software version - 10.2.5 , do we need to upgrade it or its already fixed.

[JayGolf]

HI @kdamodaran ,

On 10.2.5 you are good to go. On 10.2.4 or greater, the PA root certificates are included. 

[naeem82]

is this a bug ? we have some device some running on 10.2.5 and 10.2.4 . What action is required from our side inorder not to have any impact on production.

[robertsmyth]

HI there, I've received the same message when logging in to our firewall. Current version is 10.1.3. I followed the link on the firewall which brought me here but it tells me i do not have access permissions to get to see how i remedy this issue. Can someone please help with this...Ill happily renew the certificate if Palo Alto will be so kind as to let us know how it is done!

[naeem82]

Same here . shows access denied for me too.

[KDamodaran1]

If the firewall is running in version 10.1.3, I recommend upgrading to target version as per below snapshot. 

[KDamodaran1]

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

[jerilkcherian]

getting access denied error for this url , how to fix it ? https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-d...

[KDamodaran1]

My guess would be you have a 'free' account on the Live community instead of a customer/partner account? That page is only accessible if you have a support enabled account (access to support.paloaltonetworks.com)

[KDamodaran1]

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

[michaelx]

pan-os 9.1.11 Does the certificate expiration affect Communication between the firewall and Windows User-ID/Terminal Server Agents or firewalls?

[GarbajeTeam]

same problem here, i cant see de link because i don't have "special priviledges"

[Raul_Zuniga]

Essentially, as long as you are in one of the versions appearing in @KDamodaran1's table and install the content update 8776-8390 or later, you should be fine. Said content update pretty much carries the new certificate.

[GarbajeTeam]

Thanks