topic Re: GlobalProtect getting "Connection failed" message (sectigo ce in General Topics

GlobalProtect getting "Connection failed" message (sectigo certificate)

Marc.Luecke — Fri, 12 Jun 2020 12:44:04 GMT

Hi,

suddenly we are getting a "connection failed" message from the GlobalProtect Client while using the sectigo wildcard certificate in the TLS Profile of the NGFW.

The traffic logs show a 'decrypt-error'.

There is no decryption policy being used.

We are on PanOS 9.0.7.

It's a bit strange because everything worked just fine until now and there weren't any changes made.

Could that refer to the known sectigo certificate problem?

Is there maybe a fix for this?

Best regards,

Marc

Re: GlobalProtect getting "Connection failed" message (sectigo ce

BPry — Fri, 12 Jun 2020 12:52:34 GMT

@Marc.Luecke,

The firewall decrypts parts of GlobalProtect traffic regardless of what you have configured in your decryption rule base, and if you are using a Sectigo certificate which is cross-signed with AddTrust and UserTrust then your certificate would have been invalidated as far as the firewall is concerned on the 30th.

Re: GlobalProtect getting "Connection failed" message (sectigo ce

Marc.Luecke — Fri, 12 Jun 2020 12:59:32 GMT

Hi,

I see. Thank you very much for your fast answer.

Is there any way around this?

I assume there are several users with the same problem at this time.

Best regards,

Marc Lücke

Re: GlobalProtect getting "Connection failed" message (sectigo ce

BPry — Fri, 12 Jun 2020 13:22:00 GMT

@Marc.Luecke,

Generate a new certificate for use with GlobalProtect would really be my answer to this question. You should be able to get your wildcard certificate re-issued without the cross-signing between AddTrust and USERTrust and just have USERTrust in the chain, which would a fully valid certificate.

Re: GlobalProtect getting "Connection failed" message (sectigo ce

Marc.Luecke — Fri, 12 Jun 2020 13:24:09 GMT

I will try that.

Thank you very much!!

Best regards,

Marc Lücke

Re: GlobalProtect getting "Connection failed" message (sectigo ce

Arecio — Sat, 28 May 2022 12:28:02 GMT

Hello,

Did you manage to solve the problem, I have a similar error.

This occurs after migrating from Windows 10 to Windows 11.

Thanks for any help you can provide me.

Greetings.