Log-Collector ElasticSearch certificate fails to renew on PAN-OS 11.1.x when custom certificates are used for Log-Collector to Panorama communication
674
Created On 12/16/25 23:29 PM - Last Modified 07/23/26 20:58 PM
Symptom
- When debug elasticsearch show certs command is ran, the certificate shows historic date which means that the elastic search certificate has failed to renew.
- For example, in the output below, the certificate has expired on 11th December, 2025.
> debug elasticsearch show certs
ElasticSearch Certificate info
CA Cert
Subject: 3114e847-fa21-4762-8264-000000000d0c
Issuer: 234567-1234-5678-1358-e23456789bad0c
Validity
From: Oct 21 23:34:47 2022 GMT
To: Oct 20 23:34:47 2032 GMT
Status: CA
CC Cert
Subject: abcdef-1234-5678-b456-11abcdefghijkl
Issuer: 234567-1234-5678-1358-e23456789bad0c
Validity
From: Sep 12 04:25:45 2025 GMT
To: Dec 11 04:25:45 2025 GMT <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Status: Ok Environment
- Panorama and Log-Collector connected via Custom Certificate
- Panorama and Log-Collector PAN-OS is 11.1.x and lower.
Cause
- When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
- This is because, ElasticSearch in 11.1.x, currently relies on SC3 certs to form it's cluster.
- If the Log-Collectors are configured to use custom certs, the SC3 certs will not be available or be renewed; leading to an outage of ES.
Resolution
- Ensure that you remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates, if required.
- To check the expiry date for the predefined ElasticSearch certificates, enter the CLI command 'debug elasticsearch show certs' and then check the validity date on the CC cert in the output displayed.
- Starting 12.2.0, 12.1.5, ElasticSearch certificates will renew even when custom certs are in place.
- However, even with these PAN-OSes and later, there cannot be a mix and match between the certificate types.i.e.
> If You are using custom certficate for Log-Collector to Panorama communication, You should also use the same for the Inter-LC communication.
> If You are using SC3 for Log-Collector to Panorama communication, You should also use SC3 for the Inter-LC communication.