About RobinClayton

on 8.1.11, there are no intermediates.    Do we install the Intermediate as an extra certificate?   Thanks   Rob ... View more

No but Sectigo certs on some sites are failing even with expiration turned off 😞   Rob  ... View more

So something has been BROKEN again..   I did think updates were set to the external interface on the service router, but  I may have changed that after the updates were broken back in that autumn (northern hemi)...  With the SR for Palo Networks set on the external interface I am picking up  updates once more.. ... View more

Integrated FW/Router has been the norm for home connections for ever.    Often for business connections the service has been wires+routers but wires only is becoming more prevalent. so long as your service provider is happy to provide connection details then there is no reason to need their router.   Our main PA had both a wires only + routed connection for some time until we dropped the wires only connection.   Our other PA is on managed routers but we are going to wire only but using our own routers.... Maybe i will think on if the routers are actually needed.. ... View more

Response to my case. ------------------------------     Good day! Engineering has identified on the fix, and it is coming in upcoming releases of all major releases ie. 8.1.15, 9.0.9, 9.1.3. With the fix, we will evaluate the leaf node, and chain up to trust store. Tentative ETA is around Mid-June. I would also like to update you that we have put together a customer advisory if you would like to take a look - https://live.paloaltonetworks.com/t5/customer-advisories/decryption-errors-created-by-the-expired-addtrust-external-root/ta-p/330976 ... View more

I have expiration turned off at present , support are not being very clear. will turn it on again later and see if the cert store has updated. ... View more

From PA Support   " From a quick search, I was able to see that multiple issues have been reported with respect to Sectigo Certificates Expiration. As a workaround,you can either allow untrust cert or exclude the website from decryption which is causing issue. PA has updated with the latest CA certification, so as of now no action needed on PA certificate store. If server chain is not updated till now then that might cause issue here. Please let me know if you have any further queries or concerns regarding the case."   Awaiting their guidance on why the store is not up to date.   Rob   ... View more

The fact that https://support.sectigo.com fails as well leads me to believe that the test site is not able to correctly process the request. ... View more

Yes we are seeing this issue     Some customers are reporting it too when accessing one of our websites, but that's an external problem     I can't replicate it accessing our site externally.   I don't think it's necessarily a web hoster problem, our chain looks valid, and the certificate was only generated with it's chain in December.   I have logged a support case, I suggest you do the same.   ... View more

Any idea when the bug was introduced, I have tried searching and all I get is that it was fixed in 8.1.14.  ... View more

The alternative is to configure your MTA to accept unauthenticated SMTP from the address of the Firewall.   Rob ... View more