https://live.paloaltonetworks.com/t5/globalprotect-discussions/iphone-12-pro-max-ios-14-3-2-cert-issue-for-global-protect/m-p/410249#M1350 <P>I have been trying to get this to work for days not and I am not getting anywhere. I always seem to struggle with certs due to how they are chained.</P><P>On my Palo I have a rootca (self-signed, certificate authority), intermediateca (issued by rootca, and also certificate authority), then I cut a cert called gp-cert (issued by intermediateca, non certificate authority).</P><P>My cert profile includes the intermediateca and the SSL/TLS SP includes the gp-cert.</P><P>I have downloaded the intermediateca cert without private key in PEM format and exported the gp-cert with private key in PSK12 format.</P><P>My DNS name for my gatway/portal lets say is vpn.company.com</P><P>vpn.company.com is the CN for the gp-cert</P><P>I upload these to my iPhone11 and when I attempt to connect I get an error:</P><P>Cannot verify server identity</P><P>There is a problem with the security certificate. The identity of vpn.company.com cannot be verified.</P><P>My options are cancel or detail.</P><P>Detail gives me the certificate details and thats it.</P><P>I always remember I could click continue when this happens so did something change in iOS or is this an issue with my certs and how I have them chained or exported, or even signed?</P><P>Thank</P> Tue, 01 Jun 2021 04:35:46 GMT davidlan 2021-06-01T04:35:46Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/iphone-12-pro-max-ios-14-3-2-cert-issue-for-global-protect/m-p/410249#M1350 <P>I have been trying to get this to work for days not and I am not getting anywhere. I always seem to struggle with certs due to how they are chained.</P><P>On my Palo I have a rootca (self-signed, certificate authority), intermediateca (issued by rootca, and also certificate authority), then I cut a cert called gp-cert (issued by intermediateca, non certificate authority).</P><P>My cert profile includes the intermediateca and the SSL/TLS SP includes the gp-cert.</P><P>I have downloaded the intermediateca cert without private key in PEM format and exported the gp-cert with private key in PSK12 format.</P><P>My DNS name for my gatway/portal lets say is vpn.company.com</P><P>vpn.company.com is the CN for the gp-cert</P><P>I upload these to my iPhone11 and when I attempt to connect I get an error:</P><P>Cannot verify server identity</P><P>There is a problem with the security certificate. The identity of vpn.company.com cannot be verified.</P><P>My options are cancel or detail.</P><P>Detail gives me the certificate details and thats it.</P><P>I always remember I could click continue when this happens so did something change in iOS or is this an issue with my certs and how I have them chained or exported, or even signed?</P><P>Thank</P> Tue, 01 Jun 2021 04:35:46 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/iphone-12-pro-max-ios-14-3-2-cert-issue-for-global-protect/m-p/410249#M1350 davidlan 2021-06-01T04:35:46Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/iphone-12-pro-max-ios-14-3-2-cert-issue-for-global-protect/m-p/410303#M1355 <P>Hi</P><P>&nbsp;</P><P>Please verify that the certificates do not exceed 825 days validity (from not-before until not-after).</P><P>Reference:</P><P><A href="https://support.apple.com/en-us/HT210176" target="_blank">https://support.apple.com/en-us/HT210176</A></P><P>&nbsp;</P><P>Shai</P> Tue, 01 Jun 2021 09:35:55 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/iphone-12-pro-max-ios-14-3-2-cert-issue-for-global-protect/m-p/410303#M1355 ShaiW 2021-06-01T09:35:55Z