topic Re: Certificate trust error after updating Global protect client in General Topics

Certificate trust error after updating Global protect client

darren_g — Fri, 22 Nov 2013 00:31:40 GMT

Folks.

I've finally managed to get approval to push out an update to the latest Global Protect client, but now when we connect, we get a certificate trust error. We are using a self-signed certificate for the portal.

I've applied the fix suggested in this Trusted root CA on Global Protect Portal post - but it hasn't helped.

Can anyone suggest other places I can look to fix this? Or do I need to bite the bullet and buy a proper certificate?

Thanks.

Re: Certificate trust error after updating Global protect client

_slv_ — Fri, 22 Nov 2013 07:54:23 GMT

Did You add your Root CA cert on workstation into Trusted Root CA folder?

In my opinion it is nessasary to workstation are able to validate your certiciate.

Regards

Slawek

Re: Certificate trust error after updating Global protect client

darren_g — Sat, 23 Nov 2013 08:42:28 GMT

It's a self-signed certificate - there is no Root CA that I know of.

I'm buying a public certificate for the gateway - it's taking too much mucking around - but, as usual, PA's documentation on certificates is as confusing as hell, so I've given up trying to sort out the self-signed nonsense.

Re: Certificate trust error after updating Global protect client

_slv_ — Mon, 25 Nov 2013 09:19:16 GMT

If You used OpenSSL to generate cert You had to generate root ca first

https://langui.sh/2009/01/18/openssl-self-signed-ca/

I can recomandate free ssl cert from StartSSL

about doc's - the most important thing is to "glue" intermediate cert with your cert - the rest is intuitive

Regards

Slawek

Re: Certificate trust error after updating Global protect client

darren_g — Tue, 26 Nov 2013 00:24:42 GMT

I wish I'd known about StartSSL before I started mucking around with this.

No matter - the company has purchased a proper SSL certificate for the VPN portal, and all is well - except for the older client versions, which *still* complain about the certificate, forcing me to do a rather rushed upgrade. The current (1.2.7) client works just fine now, as does the portal page to download it from.

Cheers.