Commit Failure with error "Certificate error, reverting configuration"

• After configuring Secure Communication with Custom Certificate commit fails and it is reverted.
• On the firewall the commit job fails with the following reason:

Reason: Certificate error, reverting configuration

• In configd.log (less mp-log configd.log), the following error is displayed.

-0700 [secure_conn] Verification of Server cert was unsuccessful
-0700 [secure_conn] Verification of Server cert was successful
-0700 Warning: pan_cmsa_tcp_channel_setup(cms_agent.c:1511): cmsa: using secure_conn_ctx
-0700 Error: pan_sec_conn_client_validation_impl(pan_sec_conn_client.c:455): [Secure conn verify result] Certificate verification failed due to Error 26 : unsupported certificate purpose 
-0700 Error: pan_cmsa_tcp_channel_setup(cms_agent.c:1741): ACR: Failed to verify certificate
-0700 ACR: Panorama connectivity check failed for <Panorama Address>. Reason: Certificate error, reverting configuration
-0700 ACR: Post-commit connectivity check failed, beginning to revert config

• Panorama managed PA Firewalls
• PAN-OS 10.2 on both Firewall and Panorama
• Secure Communication between Firewall and Panorama with Custom Certificate

Panorama:

• Under GUI: Panorama > Certificate management > Certificates "FW_cert" is generated as below
• This certificate is used under GUI: Device > Setup > Management > Secure Communication setting > Customize Secure  Server Communication

• Under GUI: Device > Certificate management > Certificates "FW_cert" is pushed from Panorama template.
• This certificate is used GUI: Panorama > Setup > Management > Secure Communication setting > Certificate

• Since the same certificate is used on both Panorama and Firewall, the commit fails.

1. Use separate certificates for the Panorama and the Firewall.
2. As an example, 2 Certificates are generated, Pan_cert is used on Panorama and FW_cert is used on Firewall.

• Set-up-authentication-using-custom-certificates
• How to configure Secure Communication between Panorama and Firewalls
• Connection Server Enhancements​​​​​​​