| Cause | Prevention | |-------|-------------| | OS reinstall without TPM backup | Backup TPM owner password & persist storage | | Disk cloning across devices | Never clone TPM-bound OS images | | Panorama DB inconsistency | Run request device-certificate sync after hardware changes | | TPM firmware update | Re-enroll certificates immediately after update |


The Palo Alto firewall uses a TPM (v2.0 on newer models) to securely store:

The error public key match failed means that during a fetch device-certificate operation, the firewall read the TPM’s sealed public key blob and compared it to a regenerated value – they differ. Possible causes:

| Cause | Explanation | |-------|-------------| | PAN-OS version update (e.g., 10.2.x → 11.0.x) | TPM driver changes or key derivation function (KDF) modifications invalidate old sealed blobs. | | RMA / hardware replacement | TPM chip replaced; old cert’s pub key no longer matches new TPM identity. | | Corrupted TPM NVRAM | Power loss during TPM write operation or filesystem corruption in /opt/pancfg. | | Manually deleted device cert | request certificate fetch after manually deleting the device cert can trigger a mismatch if TPM state not cleared. | | Cloned VM (for VM-Series) | Virtual TPM (vTPM) snapshot restored on different hypervisor host causing PCR mismatch. |


Your organization utilizes auto-enrollment for machine certificates (validity 1-2 years). When the certificate renews, Windows sometimes generates a new key pair, even if "Use existing key" is checked. The new key is stored in a different TPM key slot. The firewall’s cached mapping of (Device SID, Public Key Hash) becomes stale.

Many engineers report this error appears immediately after:

Why "Updated" triggers the failure: The "updated" in the error refers to the certificate update or TPM driver update. Palo Alto’s client caches the TPM’s public key in the registry at: HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\TPMKeys

After an update, the cache key is stale. The client fails to fetch the new device certificate because the TPM returns a different public key signature.