Decryption errors to sites and services beginning March 8 2023
8098
Created On 03/08/23 15:43 PM - Last Modified 02/10/25 21:08 PM
Symptom
Increased decryption errors to sites and services beginning March 8, 2023 1200GMT
Environment
- Palo Alto Firewalls
- Supported PAN-OS
- SSL Decryption
- Manually imported DigiCert SHA2 Secure Server CA certificate
Cause
This is caused by the imported certificate "DigiCert SHA2 Secure Server CA" expiring March 8, 2023 at 1200GMT.
This certificate may have been imported due to an incomplete certificate chain as outlined in the PAN-OS Administrators Guide.
Expired Certificate:
Resolution
- Remove the expired "DigiCert SHA2 Secure Server CA" certificate from the firewalls or download the latest one from DigiCert and import it to the firewalls.
Expired Certificate:
New Certificate:
Additional Information
Steps to remove the cert:
- Login to WebUI, Navigate to Device>Certificate>Device Certificate
- Select expired certificate "DigiCert SHA2 Secure Server CA" and delete.
- After downloading the cert from digicert website
- Navigate to Device>Certificate>Device Certificate and import.