Renew Global Protect Gateway & Portal Certificates

malayalamitlokam — Wed, 22 Dec 2021 05:07:06 GMT

Hi All,

Greetings,

We are using certificate from external CA for Global Protect Portal and Gateway which is currently in production.

It is expiring next week. What will be the best way to renew the certificate.

Thank & Regards

S Prasad

Re: Renew Global Protect Gateway & Portal Certificates

TomYoung — Wed, 22 Dec 2021 17:06:28 GMT

Hi @malayalamitlokam ,

It's easy. Simply import the new certificate, and it will replace the existing one. I would export the existing certificate and key just in case. Since your existing configuration works, I would give the new certificate the same name so I don't have to change the configuration.

Depending on the CA, you should be able to get a new cert with the same private key. In which case you would not need to import the private key. This is a good doc for reference -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK. One thing I don't like about the doc is that it says you should import the server (portal, gateway) cert with the private key. This is not necessary if you generated the CSR and key from the Palo Alto or you are re-using the existing private key.

Thanks,

Tom

topic Re: Renew Global Protect Gateway & Portal Certificates in GlobalProtect Discussions

Renew Global Protect Gateway & Portal Certificates

Re: Renew Global Protect Gateway & Portal Certificates