topic GlobalProtect - Renew Certs and Upgrade Clients for remote user in production in GlobalProtect Discussions

GlobalProtect - Renew Certs and Upgrade Clients for remote user in production

GreatTest — Fri, 17 Apr 2020 11:26:21 GMT

Current CA and Device Certs need to be renewed. GP client software updated.

Can someone tell me how folks are doing this if they need an active GP VPN connection to deploy to the clients in the first place?

We do not use Portal. - and Users cannot install software on devices

Any suggestiosn?

If I should make new CA/Device certs (certs are both created on FW) assume I would need new naming conventions?

Any tips how to get the new client upgraded - when they are connected using the current client? And do not have perms to do so on their own?

Thanks - and hope everyone is staying safe/healthy

Re: GlobalProtect - Renew Certs and Upgrade Clients for remote user in prod

khans — Thu, 18 Jun 2020 21:58:29 GMT

Hi,

If they are generated on the firewall, then they can be renewed on the firewall, by selecting the certificate and clicking renew at the bottom.

You can also create new certificates for Root, Intermediate, and server. You will need to change the server certificate in the SSL/TLS profile which is being used for the Portal and Gateway, then the Root and intermediate certificates can be added to the Portal config under Portal --> Agent --> Trusted Root CA, so they're trusted for the GP connection.

If you wanted the user browser to trust the Root and Intermediate CA certificates alongside GP client, then you can also check the box next to the certificate "Install in Local Root Certificate Store"

Users should have permission to install the Root and Intermediate CAs to their local Trust Root Certificate Store.

Let us know if that helps

Thanks and stay safe!

Re: GlobalProtect - Renew Certs and Upgrade Clients for remote user in prod

GreatTest — Tue, 30 Jun 2020 15:48:58 GMT

I created new certs

Deployed over VPN while current/old certs still in use

then cutover portal/config to new CA new cert configs

all set