topic TLS/SSL profile for PORTAL + GATEWAY (GlobalProtect); must have valid cert for GATEWAY ? in General Topics

TLS/SSL profile for PORTAL + GATEWAY (GlobalProtect); must have valid cert for GATEWAY ?

mpgioia — Tue, 30 May 2017 17:06:33 GMT

I posted a question here in a config article.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Certificate-config-for-GlobalProtect-SSL-TLS-Client-cert/tac-p/158713#M2099

PORTAL just lets me hit 'accept' anyway. (of course.. as it's all self-signed..)

But GATEWAY won't let me continue ? Server certificate validation failed (again... makes sense.. cause it's self-signed.. but I would have thought I could continue anyway with a popup/trust me anyway prompt ?)

Same TLS/SSL profile set for both GATEWAY + PORTAL.

Self-signed/created CA, and server cert signed by aforementioned CA cert. This server cert is what is referenced in the TLS/SSL profile.

Re: TLS/SSL profile for PORTAL + GATEWAY (GlobalProtect); must have valid cert for GATEWAY ?

Remo — Tue, 30 May 2017 18:05:14 GMT

Did you add your self signed root cert to the client configuration in global protect portal?

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-portals/define-the-globalprotect-agent-configurations#_43122

Re: TLS/SSL profile for PORTAL + GATEWAY (GlobalProtect); must have valid cert for GATEWAY ?

mpgioia — Wed, 31 May 2017 06:03:38 GMT

That'd do it 😕 🙂 Thanks.