Hi @A.Kuszaj ,
Root and intermediate CA certificates expire, or new ones are issued, and the Palo Alto firewall's trusted CA store needs to be updated to reflect these changes. Since it was working for two years and stopped about a month ago, it's probable that a certificate in DuckDNS's chain either expired or was updated, and your firewall hasn't updated its trusted CA store accordingly. Possibly you may have to install and set the Intermediate Certificate as a Trusted Route CA. You may have to delete and recreate the Certificate Profile for this to take effect.
Here are a few things you can check:
Clarify which certificate chain you have installed to the firewall ? Refer to the article link to install correct intermediate CA on the firewall: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC
Validate the DDNS configurations referring to this document link: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-dynamic-dns-for-firewall-interfaces Please refer to this article link providing resolution for Error message: Peer certificate cannot be authenticated with given CA certificates: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLz3CAG&lang=en_US%E2%80%A9
Hope this helps,
-Kim.
... View more
