Firewall fails to register to Wildfire appliance

[ParentS]

Has anyone had TLS cert issues with firewalls registering to their assigned wildfire appliances/clusters?

When our firewalls attempt to register to an appliance, within the cluster, they appear to reject the server certificate being handed back during the exchange. The current client hello contains an SNI matching the private cloud FQDN, but the identity cert being returned by the WF-500B doesn't have a SAN field or common name matching that SNI. The firewall's system logs show a "wildfire-auth-failed" event with a description of "Server authentication failed".

I should note that we're using the cluster's built-in DNS functionality to provide load-balancing via a conditional forwarder for the cluster domain. Output from "show device-certificate status" and "show device-certificate info" all look good on the appliances.

[ParentS · Accepted solution]

So we found the issue. Firewall registration to the Wildfire clusters was failing. Running "show wildfire status channel private" on the firewall showed a global status of "Remote SSL certificate verification failed".

The cluster was using a custom DNS domain name as part of its built-in load-balancing function. This was incorrectly configured at the cluster level which caused the individual appliance device certs to differ from the FQDN being used by the firewalls. Once that was corrected and pushed via Panorama, registration started working; followed shortly thereafter by successful sample submission.