This article explains why the firewall policy deploy job fails with a BadElement: tls-profile mss-profile commit error in SD Cloud and describes the available workaround.

- During the preview operation of the firewall policy deployment, the following delta is observed

## SSL Initiation Profile Configurations ##
delete services ssl initiation profile mss-profile

- The firewall policy deploy job fails with the following commit error:

Error Type: Commit Error
deploy failed with error:[ErrorSeverity:error,ErrorPath:
[edit security log stream mss-logs transport tls-profile]
,ErrorMessage:
SSL profile must be defined under [services ssl initiation profile]
,BadElement:
tls-profile mss-profile
ErrorSeverity:error,ErrorPath:,ErrorMessage:
commit failed: (statements constraint check failed)
,BadElement:]

Any SSL Initiation profile that is not managed or pushed by SD Cloud may be removed during deployment. This behavior is consistent with other unsupported or unmanaged objects (such as Address, Service, or UTM objects). Since SD Cloud is not aware of the TLS profile mss-profile, it generates a delete statement, which causes the firewall policy deployment to fail.

Permanent bug fix has been already deployed to production to prevent SD Cloud from generating delete statements for SSL Initiation profiles during firewall policy deployment.