topic Re: Generate Certificate to be Signed by Public CA for Global Protect VPN in Next-Generation Firewall Discussions

Generate Certificate to be Signed by Public CA for Global Protect VPN

EvanRaci — Fri, 14 Jul 2023 03:07:54 GMT

Hi All,

We would like to use our GlobalProtect VPN using certificate signed by Public CA.

As the CA team is requesting to generate CSR from Palo Alto Firewall , can I follow below article to generate?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSxCAK

And we have two ISPs connected to PaloAlto Firewalls and we have two GlobalProtect VPN Gateways configured. If I want to use Public signed CA for both gateways , I need to generate separate CSR for each gateway right?

And when generating CSR , in the common name session , can I use public ip address instead of FQDN?

Please help me to confirm.

Thank you

Re: Generate Certificate to be Signed by Public CA for Global Protect VPN

rmfalconer — Thu, 20 Jul 2023 16:01:15 GMT

You can follow that link to generate a CSR.

You should generate a CSR on each node.

Public authorities will not include IP addresses as CN or SAN entries. You'll need to use FQDN.

Re: Generate Certificate to be Signed by Public CA for Global Protect VPN

Adrian_Jensen — Thu, 20 Jul 2023 17:28:44 GMT

In addition to what @rmfalconer said, be sure to add SAN entries ("Host Name" field under Certificate Attributes) for the certificate. CN (Common Name) is no longer used for hostname certificate validation, the SAN is. Also, you can have multiple SANs under a single certificate and you can have a single certificate that covers multiple Portals and Gateways.

I run a combined certificate with a default FQDN as the CN and all my explicit Portal and Gateway FQDNs as SANs on the same certificate. I.e. a CSR to be signed by an external auth with:

Certificate Name = VPN_Certs

Common Name = vpn.example.com

Signed By - External Authority

Certificate attributes:

County = US

State = Allstate

Locality = Anytown

Organization = Acme Corporation

Host name = vpn.example.com

Host name = vpn-portal-a.example.com

Host name = vpn-gateway-a.example.com

Host name = vpn-portal-b.example.com

Host name = vpn-gateway-b.example.com