Wrapped around the axle - iOS + GP + Client Certificate generated on the Palo

wesprather — Sat, 01 Aug 2026 16:32:52 GMT

I’ve got an iPad that has the GlobalProtect client installed. I’ve created self-signed certs using the PA 440 as the CA for the client auth, to enable MFA (user+pass & cert). I get this error “A valid client certificate is required for authentication. If the issue persists, contact your system administrator”.

I’ve been troubleshooting this for a couple of days. We kept running into pointers to JAMF or Apple Configurator, so I downloaded Apple Configurator and pushed the client certificate and the root CA trust chain, as well as the PA GP client instead of the manual method, *just to see* - and it acts the same way. The iPad device just doesn’t seem to recognize the client certificate and MFA fails. The EXACT same cert works on my MacBook Pro M3 without issue.

trust settings OK

Valid and trusted client auth certs. OK

Profiles in place. OK

Still.. No GO!

topic Wrapped around the axle - iOS + GP + Client Certificate generated on the Palo in GlobalProtect Discussions

Wrapped around the axle - iOS + GP + Client Certificate generated on the Palo