Client cert usage check failed

BBartik — Sat, 08 Jun 2024 18:16:08 GMT

I am testing client auth using certificates and the certificate is not being retrieved from the User store. It's Windows 11. The PanGPA.log file shows this error:

(P23516-T9764)Debug(2744): 06/08/24 11:07:10:562 box return Valid client certificate is required, remove cache and close all handle now
(P23516-T9764)Debug(5570): 06/08/24 11:07:10:562 we get cert error, so remove previousCertificate
(P23516-T9764)Debug(5528): 06/08/24 11:07:10:562 send alive message now 2
(P23516-T9764)Debug(5165): 06/08/24 11:07:10:562 client certificate error found: Client cert usage check failed

My cert has the following extensions. Am I missing something else on this cert?

X509v3 extensions:
X509v3 Subject Alternative Name:
email:aa@aaa.com
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature, Key Encipherment

Re: Client cert usage check failed

BBartik — Sat, 08 Jun 2024 20:13:04 GMT

So the issue was a user error. I created the cert via openssl but had not imported the private key into the store along with the cert. Doh!

topic Re: Client cert usage check failed in GlobalProtect Discussions

Client cert usage check failed

Re: Client cert usage check failed