| Cause | Prevention |
|-------|-------------|
| OS reinstall without TPM backup | Backup TPM owner password & persist storage |
| Disk cloning across devices | Never clone TPM-bound OS images |
| Panorama DB inconsistency | Run request device-certificate sync after hardware changes |
| TPM firmware update | Re-enroll certificates immediately after update |
The Palo Alto firewall uses a TPM (v2.0 on newer models) to securely store:
The error public key match failed means that during a fetch device-certificate operation, the firewall read the TPM’s sealed public key blob and compared it to a regenerated value – they differ. Possible causes:
| Cause | Explanation |
|-------|-------------|
| PAN-OS version update (e.g., 10.2.x → 11.0.x) | TPM driver changes or key derivation function (KDF) modifications invalidate old sealed blobs. |
| RMA / hardware replacement | TPM chip replaced; old cert’s pub key no longer matches new TPM identity. |
| Corrupted TPM NVRAM | Power loss during TPM write operation or filesystem corruption in /opt/pancfg. |
| Manually deleted device cert | request certificate fetch after manually deleting the device cert can trigger a mismatch if TPM state not cleared. |
| Cloned VM (for VM-Series) | Virtual TPM (vTPM) snapshot restored on different hypervisor host causing PCR mismatch. |
Your organization utilizes auto-enrollment for machine certificates (validity 1-2 years). When the certificate renews, Windows sometimes generates a new key pair, even if "Use existing key" is checked. The new key is stored in a different TPM key slot. The firewall’s cached mapping of (Device SID, Public Key Hash) becomes stale.
Many engineers report this error appears immediately after:
Why "Updated" triggers the failure:
The "updated" in the error refers to the certificate update or TPM driver update. Palo Alto’s client caches the TPM’s public key in the registry at:
HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\TPMKeys
After an update, the cache key is stale. The client fails to fetch the new device certificate because the TPM returns a different public key signature.