topic Re: Comp certificate expired, how to allow users to log in in GlobalProtect Discussions

Comp certificate expired, how to allow users to log in

R.Tryba — Sun, 25 Feb 2024 08:57:03 GMT

Hi,

Few of my users have not connected to GP (and to AD) for extended period of time and their computer certificate has expired.

They are remote, so coming to office would be problematic - continent-size problematic 🙂

I was under impression, that when i change Authentication profile from "Require username AND device cert" to "Require username OR device cert", I will be able to allow them to connect - that way their comp cert would renew and they'd be ok going forward.

But I was wrong, GP client was not willing to connect. i know there is a way, as previous Manager was allowing it through, but at that time I was not working on Palo's, so not sure what else I need to amend to make it happen..

Re: Comp certificate expired, how to allow users to log in

reaper — Mon, 26 Feb 2024 14:05:59 GMT

did you change this setting on both the portal AND the gateway? Make sure you're allowing it on both for those users to be able to connect

Re: Comp certificate expired, how to allow users to log in

R.Tryba — Tue, 27 Feb 2024 18:04:10 GMT

Hi,

I have today, have also as per other suggestion I saw somewhere to remove a cert profile from portal - nothing worked, it has thou for one sec showed me MFA prompt for user.. but at the end it refused to connect anyway - with same "Client certificate not found" message..

Logging call with my Palo Support company for it, but any other suggestion welcome..

Is there any way I can generate a machine cert on my CA and install it on remote comp? Problem is that I use a specific template for it and unsure if it would work if problematic machine has no access to internal CA..

Any other way of generating maybe self-signed cert on palo firewall (or Panorama) to allow it through?

Re: Comp certificate expired, how to allow users to log in

Mick_Ball — Wed, 28 Feb 2024 13:51:58 GMT

Have you checked the certificate profile to see if any options here are ticked

Re: Comp certificate expired, how to allow users to log in

Mick_Ball — Wed, 28 Feb 2024 14:03:00 GMT

Can you not email a new certificate to the users device or do they have no connection without GlobalProtect?

Re: Comp certificate expired, how to allow users to log in

R.Tryba — Sun, 07 Jul 2024 07:37:12 GMT

Hi, Just realised have not posted how we dealt with it, so just as a closure:

We have decided easiest way would be to remove cert from authentication requirements for brief moments when we have that issue, so have set "user credentials OR device cert required", allowed user to log in, then recreated cert once user was in.

After that I just changed that back to "creds AND cert required". Few minutes of lowered protection, but solved that problem just fine.