Problems with pre-logon with machine certificate

JohnHogman — Thu, 19 Oct 2023 11:49:28 GMT

Hi!

We have problems with a customer that uses GP and pre-logon with machine certificate.

It works for a couple of days, GP connects when you start your computer and works as intended.

But stops working after a while.

I can see these entries in the logs, the application seems to have som problems with the machine certificate:

P13676-T14592)Info (3434): 10/11/23 13:47:35:791 PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=000001A70A806DC0)
(P13676-T14592)Debug(3507): 10/11/23 13:47:35:791 WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12044, result=5, dwCertificateError=0
(P13676-T17060)Info (2260): 10/11/23 13:47:35:885 winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR
(P13676-T17060)Info (1649): 10/11/23 13:47:35:885 Server cert query failed with error 12019
(P13676-T17060)Debug(1561): 10/11/23 13:47:35:885 DC, dump server certificate now
(P13676-T17060)Error(1631): 10/11/23 13:47:35:885 failed to open the file C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan for reading.
(P13676-T17060)Error(2290): 10/11/23 13:47:35:885 error = ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED

Does anyone have any suggestions how to solve this?

Re: Problems with pre-logon with machine certificate

JohnHogman — Fri, 03 Nov 2023 09:36:36 GMT

The problem was that the "Subject" field in the Machine certificate was empty.

topic Problems with pre-logon with machine certificate in GlobalProtect Discussions

Problems with pre-logon with machine certificate

Re: Problems with pre-logon with machine certificate