GlobalProtect iOS Certificate issue

COlson — Wed, 08 Dec 2021 01:37:52 GMT

Hello,

I’m in the middle of trying to make a gateway for iOS devices and I’m having an issue. I use MobileIron to push out the config and it uses an MI SCEP cert; I’ve added the MI SCEP CA to the PAN device and set it up as the auth profile. If I only do UN/PW I have no issue but as soon as I add cert requirement, the iPhone GP app has an error and if I check the PAN traffic log I see my phone IP traffic behind denied with a session end reason as “decrypt-cert-validation.” Based on what I have been able to read, this might be due to a cert not being X509 compliant.

Can anyone help me understand what specifically is required in the cert or does anyone have any experience with this issue/config?

Thanks in advance.

Re: GlobalProtect iOS Certificate issue

idelconsulting — Fri, 17 Dec 2021 19:43:23 GMT

Hi,

not sure if this is related to your issue but I had problems with iOS clients when the portal certificate was valid for more than one year.

I don't have the link at hand, but basically Apple doesn't accept any certificates with a validity longer than one year.

topic GlobalProtect iOS Certificate issue in GlobalProtect Discussions

GlobalProtect iOS Certificate issue

Re: GlobalProtect iOS Certificate issue