topic Re: Global Protect users cant connect - certificate out of date in GlobalProtect Discussions

Global Protect users cant connect - certificate out of date

Kevin-OHare — Wed, 09 Feb 2022 20:21:13 GMT

Hello,

I have over 1000 users and just this week some users (maybe 10) have not been able to connect to Global Protect from home. I worked out its because their ROOTCA has expired under Manage Certificates on their laptop. Its been working for 2 years and every user seems to have different dates. As far as i know the certificate server on-prem corporate network is supposed to update their certificate periodically. It must have done this at some stage. I am not getting much response from the server team who look after the certificate server and i know the Global Protect users have routing and a the relevant ports open to connect to the cert server.

When a user cant connect he has to drive to the office and connect to the LAN. The the server team issue him a renewed certificate. Then he can go home and connect in again no problems

How do i prove the palo alto is not the problem

thanks, Kevin

Re: Global Protect users cant connect - certificate out of date

BPry — Thu, 10 Feb 2022 03:56:21 GMT

@Kevin-OHare,

Ummm ... that actually sounds like a firewall problem to me. Short of something being very oddly configured in Group Policy, I can't see how this isn't an issue with communication between the GlobalProtect clients and your PKI hosts. Sadly you would need your server team to review Group Policy and the PKI server if you don't have access to either, but if its working when a client is on-site it should be working over the GlobalProtect connection.

Re: Global Protect users cant connect - certificate out of date

Kevin-OHare — Thu, 10 Feb 2022 11:38:28 GMT

Thanks for the reply - i have got two users to go into site and the server team had to remote onto their laptop and do the following

Start
Manage computer certificates
Personal
Root certificates
… issued by ROOTCA - click on the certificate and renew it

Should this not be an automatic thing that happens once a year.