topic Subject: GlobalProtect Connection Issue After SSL/TLS Certificate Renewal in Next-Generation Firewall Discussions

Subject: GlobalProtect Connection Issue After SSL/TLS Certificate Renewal

Jagdeep1 — Fri, 01 Aug 2025 22:18:34 GMT

Hello Team,

We’re currently experiencing an issue where GlobalProtect is not accessible after renewing the server certificate associated with the SSL/TLS profile used by our GlobalProtect portal.

Error message:
GlobalProtect: Connection Failed. The network is unreachable or the portal is unresponsive. Check the network connection and reconnect.

The portal is also not loading in a web browser, returning a ERR_TIMED_OUT error.

Additional details:

We confirmed that traffic is reaching the firewall and hitting the correct interface.
We have two portals configured on different interfaces. The second portal (which still uses the old certificate) is functioning normally.
We’ve already restarted sslmgr, sslvpn-web-server, and the management server.
PAN-OS version: 11.1.4-h13

Has anyone encountered a similar issue after a certificate renewal? Any suggestions or insights would be greatly appreciated.

Thank you!

Re: Subject: GlobalProtect Connection Issue After SSL/TLS Certificate Renewal

Mudhireddy — Sun, 03 Aug 2025 17:19:15 GMT

I've seen this issue before. The fact that the other portal works points directly to the new certificate or its configuration on the affected portal. The ERR_TIMED_OUT error is likely a symptom of a failed SSL handshake.

Here's a quick checklist to troubleshoot:

Certificate Chain:
- Confirm the new certificate and its intermediate CAs are all correctly installed and linked. A missing intermediate cert is the most common cause.
SSL/TLS Profile:
- Verify the new certificate is correctly assigned in the SSL/TLS Profile for that portal.
- Check for any restrictive TLS versions or cipher suites in the profile.
Logs and Packet Capture:
- Review the firewall's system, GlobalProtect, and sslvpn-web-server logs for specific errors.
- Run a packet capture on the external interface to see where the SSL handshake is failing.

This issue is almost always a certificate or profile misconfiguration. Let's start by methodically checking those first.