How to Fix peer certificate cannot be authenticated with given CA certificates?

Published: 08 Sep 2017
Last Modified Date: 08 Jun 2022

Issue

When refreshing an extract or loading a view which is using a Google data source, the following errors may occur:

"Internet communication error: Peer certificate cannot be authenticated with given CA certificates

Inhaltsverzeichnis Show

Environment
How do you fix Peer's certificate issuer has been marked as not trusted by the user?
How do I add a certificate to ETC PKI TLS certs CA bundle CRT?
How do I get a CA trusted certificate?
How do I update my CA certificates?

"Unable to connect to data source with the supplied credentials, or no credentials provided."

Environment

Tableau Server
Tableau Desktop
Google BigQuery
Google Sheets
Google Analytics

Resolution

Please consult with your internal IT team, before carry out the following steps to install the GS Root R2 certificate:

In a web browser, go to https://pki.goog/
Download the GS Root R2 certificate by clicking 'DER' in the Links column for this root CA.
Double-click the GSR2.crt file, and select Install Certificate.
Select Next and complete the Certificate Import Wizard.

If installing the above root certificate does not resolve the issue, please carry out the following steps to install the subordinate CA for GS Root R2 - GTS GIAG3:

In a web browser, go to https://pki.goog/
Download the subordinate CA for GS Root R2 - GTS GIAG3 by clicking 'DER' in the Links column for this subordinate CA.
Double-click the GTSGIAG3.crt file, and select Install Certificate.
Select Next and complete the Certificate Import Wizard.

Cause

This error may occur because Google has changed their SSL certificates. In some cases, the trust chain is defined differently from their previous certificate.

Last updated
Save as PDF

Views:245Visibility:PublicVotes:0Category:ontap-9Specialty:coreLast Updated:

Issue

ONTAP provides support for HTTPS and FTPs for various commands. While attempting to use an HTTPS or FTPs server, the following error might be seen:

cluster1::*> system node image get -node cluster1-01 -package https://example.com/Firmware/SP_FW.zip
Install Failed.
Failed to download package from https://.../SP_FW.zip. Error: Peer certificate cannot be authenticated with given CA certificates

13924

Created On 05/16/19 03:25 AM - Last Modified 01/16/21 04:03 AM

Symptom

When creating the certificate profile and using it in one of the features on the firewall, error on system logs:

Server response: Peer certificate cannot be authenticated with given CA certificates

Packet capture displays "Unknown CA" after the exchanging of the server certificate packet

Environment

PAN-OS 9.0
Palo Alto Firewalls.
Certificates Configured

Cause
Incorrect Certificate in the certificate Chain causes this error. Either the Root or the Intermediate certificate is not matching correctly.

Resolution

Check the certificate being used:

Capture the certificate being sent by the "Server" and compare it with the stored certificate on the "Firewall". The server certificate can be found by doing packet capture and navigating to the server key exchange packet.

(Secure Sockets layer > TLS Record layer > Handshake protocol > certificate)

If cert is incorrect or missing, then download the missing certificate:

If needed, the Certificate can be downloaded from the Wireshark packet capture of "Server". Use the context menu (right-click) and save the raw data of the certificate with Export Packet Bytes into a file
With OpenSSL, run openssl x509 -inform der -in cert.der -text to view the certificate
With OpenSSL, run openssl x509 -inform der -in cert.der -outform pem -out cert.crt to convert cert into PEM format

Then upload the PEM file to the firewall. Use the new certificate in the certificate profile for the firewall.
Commit the changes to the Firewall. Now the issue should be resolved.

Attachments

How do you fix Peer's certificate issuer has been marked as not trusted by the user?

You can do this in two ways..

Set SSL Verify to false only for specific repo: git config http.sslVerify false..

Set SSL Verify to false Globally: git config --global http.sslVerify false..

How do I add a certificate to ETC PKI TLS certs CA bundle CRT?

Linux (CentOs 6).

Install the ca-certificates package: yum install ca-certificates..

Enable the dynamic CA configuration feature: update-ca-trust force-enable..

Add it as a new file to /etc/pki/ca-trust/source/anchors/: cp foo.crt /etc/pki/ca-trust/source/anchors/.

Use command: update-ca-trust extract..

How do I get a CA trusted certificate?

Expand Policies > Windows Settings > Security Settings > Public Key Policies. Right-click Trusted Root Certification Authorities and select Import. Click Next and Browse to select the CA certificate you copied to the device. Click Finish and then OK.

How do I update my CA certificates?

Installing a CA Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it) into /usr/local/share/ca-certificates and name it with a . crt file extension. Then run sudo update-ca-certificates .