Errors - ROOT CA authority untrusted / invalid

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Errors - ROOT CA authority untrusted / invalid

L1 Bithead

PA-VM Series 8, vm-mode: Microsoft Azure

sw-version: 10.1.6-h6 global-protect-client-package-version: 5.2.1

 

Issue:

when trying to access websites, we are getting a lot of errors saying that the ROOT CA authority is untrusted/invalid

 

Error details: Received fatal alert CertificateUnknown from the client. CA Issuer URL (truncated):http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA

 

Certificate Information,

CA- Trusted Root CA

status Valid

 

8 REPLIES 8

L3 Networker

Hi,

The error states this has come from the client and means that the client does not trust the issue URL. Palo has pulled out the originating CA Cert for you but the issue is most likely you are doing decryption and the client does not trust your decryption cert. This is either because:

1) it does not have the decryption cert chain installed and/or trusted

2) the browser is not using the machine trust store (e.g. firefox) and maintains its own trust store that will need the cert chain adding

 

We also see this when the traffic is from inside an application that does not use the machine trust store, or is doing cert pinning but you state your issue is with browsing so probably not that.

 

Cheers,

Shannon

L1 Bithead

I will try  & let me know.

As a test, or if you completely trust this particular website, you could also exclude it from decryption; but I always prefer to resolve it properly and allow the firewall to decrypt and inspect the traffic for threats instead of just excluding decryption and blinding trusting it.

Hi,

 

Anyone get the solution for this issue. we are getting the same issue 

Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20ECC%2

We are looking for the permanent fix as solution given in below article is the workaround for which lot of manual task need to do.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

Cyber Elite
Cyber Elite

Can you give one example URL where you get CA cert error?

This usually happens if website don't include intermediate cert in the chain.

Windows download intermediate certificates automatically but Linux (and Palo) does not.

 

Unfortunately vast amount of website admins have no idea how certificates work and what they should include...

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi , 

Any solution for that problem 

Thank you 

Cyber Elite
Cyber Elite

Problem is not on the firewall but clueless website administrators who don't follow standards.

 

RFC states:

“If the server is authenticated, its certificate message must provide a valid certificate chain leading to an acceptable certificate authority.”
https://datatracker.ietf.org/doc/html/rfc5246

 

If website does not attach intermediate in cert chain then you can either remove those sites from being tested against trusted CA check or upload those intermediate CA certs into Palo manually.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 2925 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!