topic CRL for Globalprotect in GlobalProtect Discussions

CRL for Globalprotect

g-crisostomo — Thu, 23 Feb 2023 15:37:56 GMT

Hi, greetings.

Is there a way to use the CLR to verify the machine/user certificate through globalprotect, to drop connections if the certificate is revoked?

Re: CRL for Globalprotect

TomYoung — Thu, 23 Feb 2023 15:56:25 GMT

Hi @g-crisostomo ,

GP uses a Certificate Profile to authenticate certificates, and it has a check box to use CRL. Theoretically, the authentication should fail if the certificate is revoked. Please let us know the results if you configure it!

Thanks,

Tom

Re: CRL for Globalprotect

g-crisostomo — Thu, 23 Feb 2023 16:40:59 GMT

I have marked this option, but how can I assure the CRL is being used?

I added the URL from the certificate to the Default OCSP URL but still I can't see how I can refer to the list.

Re: CRL for Globalprotect

TomYoung — Thu, 23 Feb 2023 16:47:44 GMT

Hi @g-crisostomo ,

OCSP is a different protocol. If you check the URL box, for every certificate authentication request the NGFW should check the CRL listed in the CA certificate in the same certificate profile. The best way to check is to revoke a certificate and see if the authentication fails. If traffic from the management interface to the CRL URL goes through the NGFW, you should also see the session in the logs.

Thanks,

Tom

Re: CRL for Globalprotect

g-crisostomo — Wed, 01 Mar 2023 12:08:13 GMT

Thank you for your help, I guess I found out whats going on; The CRL listed on certificate in the firewall, is different from the user's certificate CRL, because they have 2 servers issuing certificates and they didn't point me this until now.

Thanks once again.