Global Protect Android client failing with certificate error after upgrading PAN-OS

idelconsulting — Thu, 11 Jun 2026 18:07:19 GMT

Dear all,

I have a strange error after I upgraded my firewall to PAN-OS 11.1.15 to fix a GP vulnerability.

(18990)06/04 17:44:57:208734 - PanKeyManager: Issuers: CN=ixxx, DC=ixxx, DC=local
(18990)06/04 17:44:57:208841 - PanKeyManager: Use Cert: gp_user_new
(18990)06/04 17:44:57:208883 - PanKeyManager: getPrivateKey for alias: gp_user_new
(18990)06/04 17:44:57:250906 - PanKeyManager: getCertificateChain for alias: gp_user_new
(18990)06/04 17:44:57:395190 - PanHttpsClient: 1738, found exception:javax.net.ssl.SSLHandshakeException: Read error: ssl=0x7a7d04ed18: Failure in SSL library, usually a protocol error
error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE (external/boringssl/src/ssl/tls_record.cc:486 0x7b3d077350:0x00000003)
(18990)06/04 17:44:57:395437 - PanHttpsClient: client cert is selected but invalid.
(18990)06/04 17:44:57:395543 - removeClientCertAlias...

Not much help from support so far.

User cert is generated from a Microsoft CA.

Does anyone have the exact details how the client certificate should look like if it is coming from Microsoft?

Or the detailed settings for the certificate template to use?

Regards,

Andreas

topic Global Protect Android client failing with certificate error after upgrading PAN-OS in GlobalProtect Discussions

Global Protect Android client failing with certificate error after upgrading PAN-OS