topic Re: Global Protect with self-signed certificate in General Topics

Global Protect with self-signed certificate

soporteseguridad — Thu, 21 Jan 2016 11:28:56 GMT

Hi,

We have configured GlobalProtect with a self-sign certificate working properly, but when we try to connect through global protect we always receive this advise about "this certificate is not valid...." and we have to accept it to continue. This message is quite annoying.

Is there any way to use a self-signed certificate without seeing this message???

Regards,

Re: Global Protect with self-signed certificate

syadav — Thu, 21 Jan 2016 12:26:09 GMT

Hi JC,

To avoid the certificate error when using Self signed certificate, at least you need to make sure that the "signing certificate" ie the self signed CA used to sign the portal and gateway cert is downloaded and added in the Trusted Root CA store of the end user machines.

Though there can be more complications regarding certificates (like one mentioned in the DOC below) depending on exact implementation of the GP setup. It is difficult to conclude the reason without knowing the exact setup/config.

https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-Gateway-Certificate-Error-When-Trying-to-Use/ta-p/57043

It would help if you could add the exact error message snapshot seen on the user machines and GP Agent and panOS version.

Re: Global Protect with self-signed certificate

pankaku — Thu, 21 Jan 2016 13:37:39 GMT

Is the self singed certificate a CA cert or signed by a private CA?