Problem with the DuckDNS certificate for the DDNS service.

[A.Kuszaj]

Hi,
I'm having an issue with Palo Alto and DDNS — specifically with DuckDNS. Everything had been working fine for the past two years, but for about a month now, Palo Alto is showing an SSL certificate error.
The exact error message is:

Server response: Peer certificate cannot be authenticated with given CA certificates

I’m not sure which certificate I should be using to fix this.
Has anyone encountered and resolved this issue?

[kiwi]

Hi @A.Kuszaj ,

Root and intermediate CA certificates expire, or new ones are issued, and the Palo Alto firewall's trusted CA store needs to be updated to reflect these changes. Since it was working for two years and stopped about a month ago, it's probable that a certificate in DuckDNS's chain either expired or was updated, and your firewall hasn't updated its trusted CA store accordingly.  Possibly you may have to install and set the Intermediate Certificate as a Trusted Route CA.  You may have to delete and recreate the Certificate Profile for this to take effect.

Here are a few things you can check:

Clarify which certificate chain you have installed to the firewall ? Refer to the article link to install correct intermediate CA on the firewall: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC 

Validate the DDNS configurations referring to this document link: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-dynamic-dns-for-firew... 

Please refer to this article link providing resolution for Error message: Peer certificate cannot be authenticated with given CA certificates: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLz3CAG&lang=en_US%E2%80%A...

Hope this helps,

-Kim.