topic Global Protect certificate Error: Certificate 'certname' failed to load: parse tbs certificate not supported algorithm in General Topics

Global Protect certificate Error: Certificate 'certname' failed to load: parse tbs certificate not supported algorithm

PoTski — Thu, 12 Apr 2012 18:14:51 GMT

What dose that error mean?

Im trying to get a simple certificate from an w2k8 server CA to use in the Global Protect.

The Secure WebGui certificate works fine.

Thx in adavanced.

Re: Global Protect certificate Error: Certificate 'certname' failed to load: parse tbs certificate not supported algorithm

PoTski — Fri, 13 Apr 2012 10:42:11 GMT

I found the answer after alot of researching.

The problem is in in certificate signature algorithm.

When we set up the intermediate server we choose to use RSA512 as a signature algorithm. As it turns out the PA v4.1.5 dose not support RSA512.

If you are running a windows CA and need to change the signature algorithm. See the following url.

http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/568ef7b7-5cad-4225-b35a-4630a57a3ac5

Regards

PoTski

Re: Global Protect certificate Error: Certificate 'certname' failed to load: parse tbs certificate not supported algorithm

pg_itdept — Thu, 05 Jul 2012 13:07:41 GMT

Thanks for the update. Was looking at using SSL inspection via our CA. We used 512RSA to stop Google Chrome moaning about being signed unsecurely when running MD5. Have already uninstalled and re-installed our CA to get this working, don't fancy the reg hack though.

Don't suppose you know if this is fixed in 4.1.6?

Re: Global Protect certificate Error: Certificate 'certname' failed to load: parse tbs certificate not supported algorithm

mikand — Fri, 06 Jul 2012 12:38:24 GMT

Isnt RSA512 just really bad?

At least use 1024 if your have performance concerns.

FIPS 140-2 states one should use 2048 while EU-CRYPTII says something like at least 2444 bits for assymetric encryption (in reality 4096 is the next step).

A true CA should use as high encryption as possible for example 16384 where the issued certs uses 4096 or such.