topic Re: Certificate Error in Global Protect Portal in General Topics

Certificate Error in Global Protect Portal

smithkopel — Wed, 01 Feb 2012 00:11:14 GMT

Hi All,

I'm trying to setup the Globalprotect VPN and have followed the (only partially helpful) GlobalProtect-Configuration-4.1.pdf to create certs and set everything up. When I try to connect to the portal site with my browser I get a certificate error - "Error code: sec_error_bad_signature".

It doesn't matter if I conect to the host name or the IP that I defined in the cert, I still get this error.

Does anyone know what the problem could be. Also, is there a way to actually see the certificates?

Thanks,

Kenton

Re: Certificate Error in Global Protect Portal

mbehlok — Wed, 01 Feb 2012 05:09:54 GMT

Did you import the CA and the client cert to your browser?

I had that issue as well but importing "Installing" the CA and client certs to my browser fixed that issue.

Hope that helps.

Re: Certificate Error in Global Protect Portal

Telenet — Wed, 01 Feb 2012 08:02:37 GMT

Please use the FQDN and not the host name or IP address.

With kind regards,

Olivier

Re: Certificate Error in Global Protect Portal

Ovan — Wed, 01 Feb 2012 10:28:52 GMT

Dear

i also have the same Problem and not yet to figure out.

Re: Certificate Error in Global Protect Portal

smithkopel — Wed, 01 Feb 2012 16:44:45 GMT

Do you mean use the FQDN when creating the certs? At this point my portal doesn't ahve a FQDN.

Re: Certificate Error in Global Protect Portal

smithkopel — Wed, 01 Feb 2012 16:57:17 GMT

Thanks @mbehlok, that helped a bit, now I get a 404 error saying /uro/ was not found on this server. Must be more that I'm missing inthe setup I guess. Any thoughts?

Re: Certificate Error in Global Protect Portal

jambulo — Wed, 01 Feb 2012 17:03:06 GMT

I too am getting this same error. I followed the document "GlobalProtect Configuration for 4.1" as much as I could. My Portal/Gateway does not have a FQDN, just an IP address.

Edit: Importing the Global Protect Gateway Cert allows my browser to reach the portal. BUT, I can not log in, and I get a message on the portal saying "Invalid client certificate".

Re: Certificate Error in Global Protect Portal

ekerstetter — Wed, 01 Feb 2012 17:51:37 GMT

I had a similar issue. I would get a certificate malformed error when trying to connect to the portal. I deleted all the certificates and started over. I was using underscores in the name for each certificate, I changed this to hyphens and made sure to fill out all the fields and it seemed to resolve the issue. Not sure why it did however and there is a chance that I had changed something else unknowingly during the process. It’s worth a shot I guess…

Re: Certificate Error in Global Protect Portal

Ovan — Thu, 02 Feb 2012 03:57:02 GMT

Does anyone succeed in configuring Globalprotect with OS 4.1 ? please help sharing !!!!!

Re: Certificate Error in Global Protect Portal

mbehlok — Thu, 02 Feb 2012 04:09:00 GMT

Ovan,

I actually got it to work, and it seems to work very well, at least once I got the certificates to work.

What can I do to help? I can post up part of the configuration if that will help, or even some screen shots of the GUI.

Or if you want, get me access to the firewall if its in a lab environment and I can see if I can help out.

my direct email is mbehlok (at) sslmeetings.com

BTW, GP 1.1.2 is out, give that client a try as well as it seems to work better for me.

Re: Certificate Error in Global Protect Portal

Ovan — Thu, 02 Feb 2012 06:50:42 GMT

Thanks mbehlok,

please help to post up your configuration guide with screenshots. I followed the " Configuring GlobalProtect 4.1 guide" But i didn't work.

Re: Certificate Error in Global Protect Portal

jambulo — Thu, 02 Feb 2012 14:06:02 GMT

So I finally got Global Protect to work on 4.1.2. Following the "Configuring GlobalProtect" guide won't get you anywhere. Apparently using the Palo Alto as a CA server does not work So the steps in the guide where it tells you to create a CA cert, and then the 2 other certs, do not apply. I had a Palo Alto Support Engineer take a look at our setup. What he did to make it work...

1) Generate a plain Cert in Palo Alto(Not signed and not a Certificate Authority)

2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None". Set "Server Certificate" to the Cert you made in step 1.

3) Move to Client Configuration tab > Delete any Root CA's that are set.

4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you created in step 1. Set "Client Certificate Profile to "None".

Re: Certificate Error in Global Protect Portal

mbehlok — Thu, 02 Feb 2012 16:03:06 GMT

Thanks for the update Jambulo.

I was actually able to get it to work by using the PA as the CA server.

I did have to upload the CA Cert and the Client certs to my client though in order for the client to connect, before that I kept getting cert errors.

I am on 4.1.2 PanOS and GP 1.1.2.

Glad you got it working though.

Re: Certificate Error in Global Protect Portal

smithkopel — Thu, 09 Feb 2012 00:17:54 GMT

Using a single certificate also worked for me. I had an SE come in and go through all my configuration stuff and still ran into the same error. When we did it using the single cert, everything worked fine. Since the cert is only to secure the portal to login and get the client, a single certificate should be sufficient. This also means you don't have to install the client and root cert on every machine that is going to connect to the portal. This would also enable you to use a third-party web certificate to avoid the cert error on connecting to the portal.

Thanks everyone for your help.

Of course, none of this stuff negates the fact that the documentation for this whole process is bad and in many cases just plain wrong. I'm finding that this is a trend in the Palo Alto documentation.

Re: Certificate Error in Global Protect Portal

kamish — Thu, 09 Feb 2012 15:31:18 GMT

This is an interesting thread. I have been using GP since the original release. I agree that the guide is very vague and doesn't help much.

Attached are screen shots of my config with OS 4.1.2 and GP client 1.1.2-9 and all works well. We use a root CA and sign all of the server and client certs with the CA.

Hope this helps.

Re: Certificate Error in Global Protect Portal

LCMember2723 — Fri, 10 Feb 2012 00:16:04 GMT

Hi Kamish,

Thanks very much. I've been working away on this for hours before seeing you post. My last issue was the temptation to select a value for Client Certificate Profile in the Portal Config. Please also note that after I recreated all the certs and started again, I emptied my test client browser cache and purged the certs from the cert personal store.

Works nicely now with PA based CA cert.

Re: Certificate Error in Global Protect Portal

smithkopel — Fri, 10 Feb 2012 21:55:47 GMT

@kamish do you then manually copy the certificates to the browsers on the machines that need to connect to the portal?

Kenton

Re: Certificate Error in Global Protect Portal

mwalter — Fri, 10 Feb 2012 22:25:03 GMT

Using GlobalProtect with an external CA could be documented better I suppose. The most common mistake is that the certificate that is issued by the external CA is not imported back into PANOS together with the corresponding private key and certificate chain. Usually you'd import it as a PKCS12 file.

Re: Certificate Error in Global Protect Portal

smithkopel — Fri, 10 Feb 2012 23:17:02 GMT

@mwalter my initial problems were not with a third-party CA. I was using the PA as the CA exactly as per the instructions and it still didn't work, even after sitting down with an SE. It wasn't until we did the single cert solution as documented in this thread that we were able to get it working.

Re: Certificate Error in Global Protect Portal

gebis_it — Sun, 13 May 2012 04:09:00 GMT

@jambulo: Thanks! Works for me...

I wonder if PaloAlto is willing to change the documentation if its wrong or outdated. Otherwise, we are all following the wrong documentations.