Error message: 'Failed to validate server certificate for endpoint api.paloaltonetworks.com'

• Firewall configured to send logs to Cortex Data Lake.
• The logs are not sent to CDL
• lcass agent log display "server certificate for endpoint api.paloaltonetworks.com" 

> tail follow yes mp-log lcaas_agent.log
.......
251 lcaas_agent ERROR Failed to fetch LCaaS server cert for validation check 
252 lcaas_agent ERROR Failed to validate server certificate for endpoint api.paloaltonetworks.com
....

• Palo Alto Firewalls
• PAN-OS 9.1 and above
• Logs configured to be sent to Cortex Data Lake (CDL)

1. Verify the Firewall connectivity to logging service is working fine. Refer Troubleshooting Firewall Connectivity with Logging Service
2. Try refresh of  license and certificate by using the command 

> request logging-service-forwarding certificate fetch-noproxy pre-shared-key xxxxxxxxxxxx

3. Verify the TCP ports and FQDNs required for CDL is allowed.
4. Run TCPDUMP on the management interface to capture the packets and verify the status. (by default the traffic will go through the FW MGT interface).

> tcpdump snaplen 0 filter "tcp port (3978 or 80 or 443 or 444) or udp port 53"

5. If the URLs are blocked by any intermediate device, ensure the URL is allowed. In the above example, "lic.lc.prod.us.paloaltonetworks.com" has been blocked.
6. For any further assistance, open a case with Support .