topic Re: SSL error with GlobalProtect portal and Firefox 27.0.1 in General Topics

SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Thu, 06 Mar 2014 10:59:54 GMT

Hi,

I have been setting up the GlobalProtect VPN infrastructure for our new PA 3020. Until recently, the GlobalProtect Portal was just fine, but now, with the latest Firefox update 27.0.1, I can't access the client download page with Firefox anymore. I get the error message below. I have verified with serveral different systems that with older (e.g. 26.0) versions of Firefox it works just fine. Anyone else noticed this? Can this be fixed in any way in PA configuration, or do I just need to wait for a fix for Firefox?

-Petteri

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

pulukas — Thu, 06 Mar 2014 20:46:53 GMT

See if clearing the site cookies works for this issue.

SSL Decryption Stops Working on Firefox Browser After Changing SSL Decryption Certificate

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Fri, 07 Mar 2014 10:00:25 GMT

Clering cookies did not help with the issue.

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

Retired Member — Sat, 08 Mar 2014 08:51:32 GMT

if you can;

Could you please generate a new certificate for GP and see if it is fixed

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

knarra1 — Sat, 08 Mar 2014 15:28:56 GMT

can you verify what the Max TLS version is in browser config and try lowering the version. If it is 3 , try changing it to 2 and see if that fix the issue To verify and change version: In firefox url address bar type about:config and then search for security.tls.version.max,modify the value . Close all browser windows and reopen. See if that fix the issue

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

_slv_ — Sat, 08 Mar 2014 16:14:03 GMT

I'm using polish version of FF 27.0.1 and I logged into GP portal without any issues.

I'm using StartSSL SSL certyfiacte for GP portal.

Regards

Slawek

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Sun, 09 Mar 2014 08:39:06 GMT

Hi, this is solved now. Few important pieces of imformation were missing from my original post that I think somehow affect to this. First, I have both the portal and the gateway running in the same public IP address. Second, I also use client certificate profiles for both the portal and the gateway.

What I did now was that I disabled the client cert profiles for both the client and gateway, and committed the change. After that I was able to login to portal with the latest firefox. Then I enabled the client certificate profile only for the portal, and tried to login. At this point, I got the "Valid client certificate is required", which is kind of weird as I do have the correct client certificate available in the Firefox's certificate store. But, then I enabled the same client certificate profile also for the gateway, and now I'm able to login.

So, the configuration is now identical to the original one - I merely disabled the client certificate profiles for the portal and gateway, and then enabled them back.

I guess one teaching is that if the portal and gateway are running on the same IP address, the same client certificate profiles have to used for both. In the guide it's mentioned that if the IP address is shared between the portal and gateway, the same server SSL sertificate has to be used for both. But I didn't find any notes about a need to use also the same client certificate profiles.

-Petteri

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Sun, 09 Mar 2014 08:51:20 GMT

Well, it seems that I was too quick in my conclusions. After restarting Firefox, the same problem resurfaced. But anyway, now I know it's definitely about client certificates, becuase disabling makes it possible to use the portal page with the latest Firefox as well. I'll continue by checking the proposals above.

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Sun, 09 Mar 2014 09:01:36 GMT

Lowering the TLS version in Firefox seems to have done the trick. Now Firefox prompts for client certificate, as expected:

Is there anything I can do find out if this is a:

a) bug in Firefox

b) bug in PanOS 6.0.0

c) something being wrong with my setup or certificates

-Petteri

Re: SSL error with GlobalProtect portal and Firefox 27.0.1

itsup — Thu, 27 Mar 2014 12:46:44 GMT

This seems to be fixed in Firefox 28.0.