topic ssl sever certificat can't be verified in General Topics

ssl sever certificat can't be verified

fcorvaisier — Wed, 16 Dec 2015 15:08:03 GMT

Hi,

This issue is on a Palo-Alto PA-500.

I've renewed my SSL certificate from my provider and updated it in the Palo-alto / Device / Certificates.

It tells me that this certificate is valid.

Ok. thanls.

But now that the date it should have expire is gone, my Global Protect clients have an error about the certificate that tells them that it's no more valid.

Where do I need to update the certificate, as I thought that it was stored on the Palo-Alto and checked by the client before any connection.

If anybody have any clue on how it worked, that would be nice to share.

Thank you.

Re: ssl sever certificat can't be verified

gwesson — Wed, 16 Dec 2015 17:54:00 GMT

When you installed the updated cert, did you install the full chain (cert + intermediate) as per this article:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed-by-a-Public-CA/ta-p/55523

If not, that's the most likely cause. The cert must be installed with the chain, or else all your clients must already trust the intermediate CA (or multiple intermediate CAs, if needed).

If you did just the server certificate itself and not the full chain, try doing the chain install to see if that solves it for you.

Cheers,

Greg

Re: ssl sever certificat can't be verified

fcorvaisier — Tue, 22 Dec 2015 08:47:11 GMT

Hi,

I've added the certfile then the intermediate file, but it didn't resolve so I tried to add a file with cert+interm. but it didn"t change anything.

The state is still "valid" on the PA but the client still have a message about the validity of the certificate.

Should I try to revoke the certificate on the PA and import it again ?

Re: ssl sever certificat can't be verified

amittal — Wed, 23 Dec 2015 01:50:40 GMT

Are you using the same certificate in the portal and the Gateway?

Please verify if you are getting the same error when you trying to access the portal.