topic Re: GP on Windows 11 - client certificate issue in General Topics

GP on Windows 11 - client certificate issue

santonic — Mon, 23 May 2022 09:47:28 GMT

Our customer is having issues with GP 5.2.10-6 on Windows 11. They are using client certificates for authentication and after a while a connection fails due to no client certificate present. If we check MMC the certificate is present, valid and has private key.

But GP logs say:

(P9292-T12792)Error(2290): 05/23/22 07:03:00:014 error = ERROR_WINHTTP_CLIENT_CERT_NO_ACCESS_PRIVATE_KEY

(P9292-T12792)Debug(2377): 05/23/22 07:03:00:014 winhttpObj, got ERROR_WINHTTP_CLIENT_CERT_NO_ACCESS_PRIVATE_KEY, clean cert cache now

(P9292-T12792)Debug(4578): 05/23/22 07:03:00:014 winhttpobj, cert do not has private key???? clean lastIssuerName now, data = 0000000000000000

There is a reddit post about it:

https://www.reddit.com/r/sysadmin/comments/sd3m6v/windows_11_tpm_and_vpn_issue/

But nothing on PA forums or KB. How many ppl are having similar issues? Any more info from PA support about this?

Re: GP on Windows 11 - client certificate issue

Adrian_Jensen — Mon, 23 May 2022 20:37:34 GMT

I had this exact same problem a few weeks ago on a PC which the user had upgraded to Win11 (without permission but..).

The problem is that the upgrade broke permissions for the GP client to access the private key, but it could read the public portion of the certificate just fine. Using MMC, nothing was apparent as being wrong. The fix is to manually export the user's certificate, including the private key, and save it. Delete the certificate from the user's cert store. Then re-import the saved key back into the certificate store. The GP client will now be able to read the private key. Alternatively, you can delete the old certificate and regenerate it (though you probably need to be connected/domain joined to do that in most cases).

See my previous thread:

https://live.paloaltonetworks.com/t5/globalprotect-discussions/windows11-fails-to-connect-to-portal-with-client-certificate/m-p/484315/thread-id/2718

Re: GP on Windows 11 - client certificate issue

santonic — Tue, 24 May 2022 06:31:17 GMT

Thank you for info @Adrian_Jensen

In our case it's fresh installations of Windows 11. First the access with GP works for a couple of days, weeks, months... and then it stops. After that the new client certificate has to be installed and the access starts working again.

Re: GP on Windows 11 - client certificate issue

Adrian_Jensen — Tue, 24 May 2022 15:27:58 GMT

If you export/re-import the old certificate does it work again? Or does it have to be a new certificate?

Re: GP on Windows 11 - client certificate issue

santonic — Wed, 25 May 2022 07:15:57 GMT

The certificates are marked as non exportable so they can't in a 'normal' way. I know there is a way with MimiKatz... 🙂