由于“证书链中的自签名证书”导致 PANDB 云代理服务器证书验证失败

• 防火墙和 Palo Alto URL Cloud 之间使用的代理服务器/ SSL 解密服务器。
• 系统日志（show log system ）报告证书错误

PANDB Cloud Agent Server certificate validation failed. Dest Addr: s0000.urlcloud.paloaltonetworks.com, Reason: self signed certificate in certificate chain

• Devsrv,log （less mp-log devsrv.log ）报告以下消息

Perform download from cloud with result Peer certificate cannot be authenticated with given CA certificates.
Error:  pan_cloud_agent_download_cloud_list(pan_cloud_agent_connect.c:1747): PAN-DB cloud list loading failed (ERROR:Peer certificate cannot be authenticated with given CA certificates).
Error:  pan_cloud_agent_get_curl_connection(pan_cloud_agent_connect.c:2544): URL cloud list is empty. Cannot initiate cloud connection.
Warning:  pan_cloud_agent_get_curl_connection(pan_cloud_agent_connect.c:2711): cannot elect a cloud
Failed to open connection with the cloud after 117250 consecutive tries.
path : https://s0000.urlcloud.paloaltonetworks.com/urlcloud_list, path
Downloading URL database via proxy server: XXX.XXX.XXX.XXX:8080
A connection with proxy server is established
Error:  verify_cb(pan_ssl_curl_utils.c:615): Error with certificate at depth: 1
Error:  verify_cb(pan_ssl_curl_utils.c:617): Basic Validation of x509 cert Fail ; Code :  19 
Error:  verify_cb(pan_ssl_curl_utils.c:620): Issuer = /C=XX/ST=XXX/L=XXX/O=XXX/OU=XXX/CN=XYZ
Error:  verify_cb(pan_ssl_curl_utils.c:623): Subject = /C=XX/ST=XXX/L=XXX/O=XXX/OU=XXX/CN=XYZ
Error:  verify_cb(pan_ssl_curl_utils.c:626): Failed to validate x509 cert from ctx: (19) self signed certificate in certificate chain

• XXX.XXX.XXX:8080 等代理服务器信息在每个环境中都是不同的。
• 并且在每个环境中，Issuer和Subject也是不同的。

• Palo Alto 防火墙
• 支持的 PAN OS
• 具有SSL解密功能的设备

1. 将Palo Alto Networks云服务器列入白名单，以将其排除在SSL解密之外。
2. 现在连接应该成功了。