While the error is TPM-related, a mismatch can also be triggered if the OTP used is incorrect, expired, or was generated for the wrong device.

To help narrow down the exact solution, could you provide a bit more context? Please let me know:

Fix time drift by configuring a reliable NTP server in . 2. Clear the Local Certificate State

In some cases, the internal record of the device certificate, key hashes, or claim keys on the firewall may become corrupted. This can lead to a mismatch between what the firewall has stored and what the Palo Alto backend expects, triggering the "public key match failed" error.