topic Re: Global Protect Certificate Authentication in GlobalProtect Discussions

Global Protect Certificate Authentication

L1_ENG — Tue, 14 Jul 2020 02:25:29 GMT

Hi Team,

We are using self signed certificate for user authentication signed by self-signed CA cert on Palo Alto for our global protect.

does my understanding below is correct regarding certificate expiration/renewal.

1. if CA cert expired while user cert still valid, user does not need to install renewed CA cert.

we can renew the CA cert on palo alto and user will be able to connect to global protect again.

2. If we renew user certificate (i.e user cert is still valid and we renew for 1 year), user will need to install new renewed certificate.

Thanks

Re: Global Protect Certificate Authentication

trivers01 — Tue, 14 Jul 2020 20:26:34 GMT

Hey @L1_ENG I hope all is well!

1. If the CA certificate used to sign any intermediate or leaf certificate expires, then each subordinate child ticket will be invalidated also. This is true regardless of the certificate being self-signed form the firewall itself or imported from an internal PKI.

2. If the CA certificate is generated on the firewall, and is renewed on the firewall prior to expiring, then it doesn't require being redeployed to the endpoints, as it will automatically be updated.

I hope this helps with your questions!

-Stay safe and have a great day!

Re: Global Protect Certificate Authentication

L1_ENG — Wed, 15 Jul 2020 04:28:21 GMT

Hi @trivers01!

Thank you for your response,