topic Re: Certificate Chain Requirements from External CA for Global Protect in GlobalProtect Discussions

Certificate Chain Requirements from External CA for Global Protect

GP7337 — Thu, 06 Feb 2025 17:45:01 GMT

Hi Everyone,

So I'm having issues configuring my GP as it does not allow me to select the server-cert from the TLS/SSL Service profile Window.

The server-cert is not even an option to select from within the window itself and when i try to import it from inside the TLS/SSL Service profile window - it imports but errors out saying the cert is invalid.

I noticed that the certificate chain I got from SSL.com that I imported doesn't have a check mark on the key column under the server cert, I only have a checkmark under the key column for the root cert which overwrote the CSR.

So the question I have is - how do I get a key check mark to appear under the Server-Cert inside the cert chain? Do I have the wrong type of SSL cert? What am I missing?

Thanks in Advance Everyone!

Re: Certificate Chain Requirements from External CA for Global Protect

Naga_Chaturvedi — Fri, 07 Feb 2025 05:41:54 GMT

As per the image it into firewall along with ROOT-CA cert private key is also imported, but for server/ssl cert only certificate is imported not key, Without private key it wont appear in SSL/TLS profile settings, Reimport the certificate along with private key.

Re: Certificate Chain Requirements from External CA for Global Protect

GP7337 — Fri, 07 Feb 2025 15:11:43 GMT

Hi Naga,

Thanks for your reply! 🙂

So this is part of the problem I don't have a key for the server cert specifically as the cert I received is part of a certificate bundle.

When I try to import the CSR key that was used to generate the external CA's certificate chain it errors out saying the key isn't valid.

So is there a specific attribute or a type of cert I need in order to get this to work?

Thanks,

Gary

Re: Certificate Chain Requirements from External CA for Global Protect

GP7337 — Mon, 24 Feb 2025 15:01:54 GMT

Just a heads up this was fixed - when you are importing the certs into the firewall do not overwrite the CSR until you are importing the server cert portion of the certificate chain. This way the key will be paired properly with the server cert.
Hope this helps someone in the future 🙂