Unable to access the GUI of Palo Alto device
27396
Created On 11/04/22 07:17 AM - Last Modified 07/07/26 02:20 AM
Symptom
- Unable to access Web-GUI, from Google Chrome the error message is 'ERR_CONNECTION_REFUSED'
- System logs show 'websrvr' process exits frequently
>show log system direction equal backward 2023/04/12 07:25:55 high general general 0 websrvr: Exited 4 times, waiting 120 seconds to retry 2023/04/12 07:23:53 high general general 0 websrvr: Exited 4 times, waiting 120 seconds to retry
- System logs generate critical crypto errors for the certificate key expiry
>show log system direction equal backward
2023/04/12 07:23:30 critical crypto cert-ex 0 Shared certificate device-mgmt and corresponding key have expired
- 'masterd.log' show 'websrvr' restart triggered by web certificate expiry
> grep pattern websrvr mp-log masterd.log
2023-04-12 07:23:32.788 +0000 INFO: websrvr: User restart reason -triggered_by_web_certificate_expiry
Environment
- Palo Alto Firewalls
- Supported PAN-OS device
- Certificate Profile configured for Web UI access
- 'Certificate Expiration Check' is enabled.
Cause
- The certificate configured to secure Web-GUI access was expired.
- 'websrvr' process is not allowed to run on an expired certificate.
- When checking for the certificate it displays expired (GUI: Device > Certificate Management > Certificates > Device Certificates)
- This is the exact certificate used for web access under SSL/TLS Service Profile (GUI: Device > Certificate Management > SSL/TLS Service Profile)
Resolution
Solution 1:-
- To regain access to Web-GUI, restart the management-server process
- debug software restart process management-server
- Renew or Replace the expired cert
- Delete the SSL/TLS Service profile configured to secure Web-GUI.
>configure
#delete deviceconfig system ssl-tls-service-profile
#commit
#exit
Additional Information
- From PAN-OS - 10.2 onwards, masterd.log has changed to md_info.log. So we need to check the log.
grep pattern websrvr mp-log md_info.log