topic GP Connection Failed - gateway could not verify the server certiticate of the gateway. in GlobalProtect Discussions

GP Connection Failed - gateway could not verify the server certiticate of the gateway.

PA_nts — Fri, 05 Apr 2024 14:21:25 GMT

Hi All,

I have GP setup and working like a dream..... most of the times.

however i have a strange issue.. and seems to only affect Azure cloud PCs at the moment, normal users with laptops and desktops can connect no problem.

my certs are all valid and signed by an external CA.

however on Azure cloud PC's the connections are very intermittent.. works maybe 1/6 attempts. most of the time users get the error around unable to verify the certificate on the gateway.

pan-os running 10.1.10-h2

gp app version is 6.1.2

windows cloud PC running windows 365 enterprise, 2vCPU, 8gb and 256 GB SSD

tried deleting dat files on local drive, no luck.

tried unistall / reinstall GP app no luck.

tried with full admin rights, same issue.

tried installing the certs locally to the PC's in the certificate store.. no luck.

from these cloud PC's, i can log into the portal fine and no complaints about certificate

any ideas doubt there are much testing around these as yet.. might have to log a call with MS also.

thanks in adv

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

Claw4609 — Fri, 05 Apr 2024 15:54:50 GMT

Hello,

Do verify, is your Gateway certificate a public cert or just the portal? And do you Azure machines trust this public root/intermediate certificate?

I would also check the GlobalProtect logs on the firewall gateway and see if there is any more error information that points to anything.

I would also check the clients GlobalProtect debug logs, specfically the pangps and pangpa logs, as there should be more information related to specifically what it didnt like.

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

matt — Wed, 19 Feb 2025 14:09:10 GMT

Did you ever find a fix for this? I am dealing with the same problem. Thanks.

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

PA_nts — Thu, 20 Feb 2025 06:40:36 GMT

Hey Matt,

shu long time ago..

yes it was resolved and the issue in our case was down to the users not having the correct permissions on the cloud PCs to install the certs locally.

I think the Application teams in the end included the certs to install when they did a cloud pc rollout/deployment.

rgds

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

matt — Thu, 20 Feb 2025 10:40:39 GMT

Thank you for taking the time to reply.

If you are able to provide any further insight then please do, this issue is getting old fast and I want it resolved!

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

PA_nts — Thu, 20 Feb 2025 11:41:08 GMT

I dont have more info unfortunately..

what you can do however, is export the cert from the portal, then connect to the cloud PC. and see if you can install said certificate from your portal to your local certificate store with the account that does not work.. chances are you wont be able to due to insufficient permissions..

If this is the case, then try and elevate the permissions to admin rights or similar and retry the cert install - if this works and install then log out, change your permissions back to what it was.. log back in and test.. if this works then you have found your issue..

then you will need to work with the system admin to allow users to add this cert to their local cert store.. another option is for them to do this via the group policy (assuming you are running windows ad) to install the certs locally on these machines.

sorry it is all the info i have atm

good luck.

Re: GP Connection Failed - gateway could not verify the server certiticate of the gateway.

M.omweno — Fri, 16 Jan 2026 22:34:57 GMT

I ran into this same issue adding an external local datecenter gateway to our prisma services. I couldn't find a resolution from my palo PS service so I went troubleshooting:

The resolution is to add the gateway certificate to the Portal under: Network Tab, GlobalProtect, Portals, open the GlobalProtect Portal Configuration, Click on Agent, and under "TRUSTED ROOT CA" add the Gateway certificate and check "INSTALL LOCAL ROOT CERTIFICATE STORE"

This will install the certificate to the client when it connects to the portal and allow the client to verify the certificate when connecting to the gateway.