I've just upgraded a customers pair of 7200 controllers to 6.4.3.1 and the active PAN profile shows the Palo Alto "Down" with nothing sent. A packet capture on the controller showed a failure in the TLSv1 exchange with the certificate - "unknown CA" when I rolled back the code to an earlier 6.4 version it started working again. Anyone any ideas what the issue might be?