topic Re: GlobalProtect 5.0 for iOS 12 and User Certificates in General Topics

GlobalProtect 5.0 for iOS 12 and User Certificates

MarkRosenecker — Mon, 17 Sep 2018 21:43:27 GMT

I have several customers (and my homelab) that leverage user certificates issued from Active Directory Certificate Authorities as a second authentication factor. Since upgrading to the new 5.0 client for iOS, the client errors out on connection to the portal, indicating that the required certificate cannot be found. If I attempt to connect to the same portal via the 4.1 client, it works flawlessly. Upgrading to iOS12 prevents me from using the 4.1 client, and I fear that many of my customers' users will upgrade their own devices to iOS12, not knowing the problems this may cause.

Is anyone else having problems with user certificates and the new 5.0 client?

Thanks!

Mark Rosenecker

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

gwesson — Mon, 17 Sep 2018 22:06:58 GMT

This is expected, because of the way Apple changed the way certificates are handled in iOS 12 compared with 11 and older.

The new features guide talks about it under the "Authentication

https://www.paloaltonetworks.com/documentation/50/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-5_0/globalprotect-app-for-ios-user-experience-enhancements

The location of the certificates in iOS 11 is different than iOS 12, so you'll need to re-import the certs. The steps are different for admins who manage their devices with an MDM versus unmanaged devices.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

sarao — Mon, 17 Sep 2018 23:17:58 GMT

For MDM based client certificate deployments, please refer to the following link for more details:

https://www.paloaltonetworks.com/documentation/50/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-5_0/globalprotect-app-for-ios-user-experience-enhancements/mobile-device-management-changes#id12e8cc2f-9d41-4984-8644-dc71b2a6116c

These changes were pre-announced in July 2018 on live articles and also as part of GP App 5.0 Beta program.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

MarkRosenecker — Tue, 18 Sep 2018 02:07:34 GMT

Thank you, gwesson! That was a very helpful post! I will re-import my certs and check again.

I had only become aware of the new client when the old client had an "update". When run on iOS 11, it exhibited the same problem (which makes sense, if it's looking in a non-existant location for the certs). I chalked it up to a .0 bug.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

MarkRosenecker — Tue, 18 Sep 2018 02:14:25 GMT

Sarao,

I appreciate your reply, but there are a few things:

1) I'm not using an MDM, so that portion is not applicable to me (or my customers).

2) I never saw any pre-announcement about GP 5.0, and I'm a platinum partner, a CNSE (before it was called PCNSE) since 2012, and multiple-PSE certified engineer. I was also at SKO a few weeks ago as well, and I didn't hear a thing about it. Granted, I don't spend my days whiling away on Live Communities...

3) I obviously wasn't part of the beta program (otherwise I'd have found this problem long ago and resolved it).

Perhaps I was reading too much into your reply (it is 10pm, and I've been up since 3am), but there was a condescending tone to it that I did not appreciate. If I am wrong, I am sorry for my misinterpretation. If I am right, please exhibit more tact in the future, when addressing other professionals.

Thank you!

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

icartwright — Tue, 18 Sep 2018 12:13:37 GMT

Hello all,

Can someone detail the steps they took to "reimport" the certificates for an unmanaged iOS device? I reimported the certs I use for Global Protect and I still can't authenticate to my Gateway. I used the same steps to import the certs that I've always used: email the certs to myself; import in this order: CA, Intermediate, Client; trust the CA under Settings>General>About>Certificate Trust Settings. I still get the same error I was getting before:

GlobalProtect gateway user authentication failed. Login from: xxx.xxx.xxx.xxx, Source region: US, User name: , Client OS version: Apple iOS 12.0, Reason: client cert not present, Auth type: profile.

BTW: I use two-factor auth in the form of local username/password and a shared client certificate.

Thanks.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Mick_Ball — Tue, 18 Sep 2018 20:44:12 GMT

Hi @icartwright, yeah, me too....

i have upgraded to ios 12 and gp 5 and removed all certs and re emailed and installed.

GP is stating no client certificate found but when i browse to my portal via safari it accepts the cert.

please update if you manage to resolve.

thanks.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

gwesson — Tue, 18 Sep 2018 21:16:05 GMT

Yep, emailing them won't work anymore. Apple removed the ability for VPN applications to access certs that are emailed as a standalone file (.p12, for example). The portal works from Safari because it's not initiating a VPN tunnel, so it can access the keystore.

You can deploy them using Apple Configurator in a .mobileconfig file, which CAN be emailed to be installed.

It's a pain, but it's universal with all VPN apps in iOS 12 (not just GlobalProtect).

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Mick_Ball — Tue, 18 Sep 2018 21:26:08 GMT

@gwesson, hi.

many thanks for your reply and information,

not really a pain as all our ipads are sent profiles via the cofigurator.

i was just playing with mine and i usually test cert auth by email.

i can of course still do this via safari but will now ensure that when our ipads are upgraded to V5 a new profile will follow.

once again, many thanks for your time and prompt reply.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

MarkRosenecker — Tue, 18 Sep 2018 23:45:33 GMT

So, that essentially means that I (and my customers) need to have a Mac or an MDM system, in order to distribute certificates. That totally, utterly sucks.

#HackintoshTime

Thanks again, gwesson! You've been an immeasurable help!

@gwesson wrote:
Yep, emailing them won't work anymore. Apple removed the ability for VPN applications to access certs that are emailed as a standalone file (.p12, for example). The portal works from Safari because it's not initiating a VPN tunnel, so it can access the keystore.

You can deploy them using Apple Configurator in a .mobileconfig file, which CAN be emailed to be installed.

It's a pain, but it's universal with all VPN apps in iOS 12 (not just GlobalProtect).

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

icartwright — Wed, 19 Sep 2018 10:53:49 GMT

@gwesson @MarkRosenecker I wouldn't say that this is a universal issue for all VPN vendors... If one were to search the interwebs for KB43862 of a competitor's product, one would find instructions for how to use email to distribute the certificates and add them to the proper app so that they can be used with SSL VPN. This particular process does not work for GlobalProtect at the moment, but I would hope that PANW updates the GP app very soon to support it.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

MarkRosenecker — Wed, 19 Sep 2018 13:08:53 GMT

So, I was finally able to get it working, leveraging an old Mac and Apple Configurator 2. It's not straightforward, but it is working.

Open Apple Configurator 2

Connect your iPhone via USB (you may be prompted to download and install an update...do this, and wait for it to complete successfully)

Create a new Profile (File -> New Profile)

Within the new profile, add your certificates (CA certificate, user certificate)

Within the new profile, create a VPN connection

-Name the VPN connection GlobalProtect 2

-Connection Type = Custom SSL

-Identifier and Server are the DNS name of your GP Portal

-Account is the username you're going to use (make sure it matches what's in the user cert)

-Under User Authentication -> Authentication Type for Connection, select Certificate

-Under Credential for Authenticating the Connection, select the certificate you added to the profile (user cert)

-Save the profile and close the profile window

In the main Apple Configurator 2 window, double-click on your iPhone.

Click on the Profiles icon on the left

Click on the Add Profile button (or the plus in the top-right)

Select the profile you created above (this will push the profile to your iPhone)

You will likely be prompted to install the profile on your iPhone (it will need to be powered on and unlocked), and it will ask you for your passcode.

This is what worked for me...I finally got cert auth working again.

Thanks to @gwesson for pointing me in the right direction!

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

qd_056 — Thu, 20 Sep 2018 01:57:13 GMT

How can we get this work if users only have Windows PC?

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Mick_Ball — Thu, 20 Sep 2018 12:49:40 GMT

hmmm i think you can ren a Mac OS X emulator for Windows....

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

APatel — Thu, 20 Sep 2018 22:09:27 GMT

The steps from @MarkRosenecker above ended up working for me as well. Initially I skipped the VPN profile steps, but found out that it is needed to make it work. I am now seeing a new issue. I have my PA3020 configured to allow saved passwords, however in the new 5.0 app, its prompt me for a password each time i connect. Anyone else seeing the same behavior?

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Jochen.Reinecke — Thu, 04 Oct 2018 08:35:43 GMT

Hello everyone,

i would like to implement IOS12 and GP 5 App on Apple Devices like it did with the IOS11 + GP Legacy app. In fact we're using AD-Authentication on Portal and AD Athentication as well as Certificate Profiles for the gateway. A machine certificate is deployed to the iOS device (also the Enterprise CA Root Cert). The Certificate Profile allows certificates from this CA.

This way was possible up to version 5 and also runs great with our windows machines. Is this a supported way? Do i have to use user certificates? Any experience or guidance?

Thanks,

Jochen

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Mick_Ball — Thu, 04 Oct 2018 15:51:25 GMT

this will still work but you will need to re send the certificates to the devices via a profile from the apple configurator, this is explained in earlier posts.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

Jochen.Reinecke — Fri, 19 Oct 2018 06:50:31 GMT

Hey MickBall,

thanks for your reply.

We were able to use machine certs finally, but only when we push them out through AirWatch MDM. Apple Configurator or Mailing-Apps doesn't work (with the same certs).

So, we're hopefully done. Good luck everyone else in testing!

Regards,

Jochen

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

deagle50 — Sat, 26 Jan 2019 00:12:57 GMT

@APatel wrote:
The steps from @MarkRosenecker above ended up working for me as well. Initially I skipped the VPN profile steps, but found out that it is needed to make it work. I am now seeing a new issue. I have my PA3020 configured to allow saved passwords, however in the new 5.0 app, its prompt me for a password each time i connect. Anyone else seeing the same behavior?

I am seeing this behavior. It prevents the app from reconnecting once the iPhone is disconnected from the internal network.

Re: GlobalProtect 5.0 for iOS 12 and User Certificates

BrandonWright — Wed, 14 Aug 2019 13:00:23 GMT

Hello All,

I spent some time with this problem. All of the information here is correct, however there aren't a lot of correct examples of using Apple Configurator to generate a .mobileconfig file to install on iOS if using client certificate authentication. I have found the following guide gets you almost all the way there (Certificates loaded, and vpn profile, but missing the Provider Bundle ID):

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boSUCAY

IMPORTANT NOTE, THE ABOVE DOCUMENT SEEMS TO BE MISSING THE FOLLOWING KEY CONFIGURATION:

On Apple Configurator, there is a Provider Bundle Identifier that needs to have "app:com.paloaltonetworks.globalprotect.vpn" filled in, otherwise the iOS Global Protect App won't use the profile contents.

Hope this helps.