Invalid SSL certificate message when adding credentials for Palo Alto Polling settings

6/28/2019 8:11 PM

5/5/2025 10:51 PM

The Credentials for Palo Alto API aren't saved, and you see an invalid certificate warning while testing the credentials. Hitting 'Submit' on the Edit Node page and re-editing the node shows that the credentials aren't saved when the page re-loads.

Network Performance Monitor

This message can occur when one of the following reasons is true:

1. Certificate is not signed by a trusted certificate authority.
2. Certificate is not within the validity period or expired
3. Certificate is issued to a common name that does not match.

Scenario 1: Certificate is not signed by a trusted certificate authority

If a certificate is self-signed and not signed a public certificate authority (CA), each node will produce the following error message and must be manually accepted.  Once accepted, this certificate will be added to node setting to avoid the prompt in the future.  Please note, if a new self-signed certificate is generated on the Palo Alto firewall, the new certificate must be manually accepted again

If the certificate is signed by a public CA, please add the root certificate to Trusted Root Certificate Authorities store on the poling engine.

1. Open Microsoft Management Console (MMC).
2. From the File menu, select Add/Remove Snap In.
3. The Add or Remove Snap-ins window appears.
4. From the Available snap-ins list, choose Certificates
5. Select Add

6. In the Certificates snap-in window, select Computer account
7. Select Next
8. In the Add or Remove Snap-in window, select OK

9. From the the MMC snap-in, select Console Root in the left pane, then expand Certificates (Local Computer) > Trusted Root Certification Authorities
10. Right-click Trusted Root Certification Authorities folder
11. Select All Tasks > Import
12. Follow the prompts in the wizard to import the root certificate
13. Click OK

Scenario 2: Certificate is not within the validity period or expired

If the certificate is past the expiration date, a new certificate will need to be created.  If the certificate is signed by a public CA, please reach out the CA to issue a new certificate.  The validity period is based on the time settings of the polling engine.  If the certificate is within the validity period, check the time setting on the polling engine are correct.