topic Re: Global Protect - Linux Fedora , CA trusted cert error in General Topics

Global Protect - Linux Fedora , CA trusted cert error

PiankaMariusz — Wed, 31 Oct 2018 18:07:36 GMT

Hi There,

I'm having the same issue but not on self signed certificate and on linux ( Fedora 29)

Global Protect is configured with the certificate signed by the Authorized CA.

The Chain is:

DigiCert Global Root CA
DigiCert SHA2 Secure Server CA

Server certificate.

It works perfect on Windows.

On Linux, Fedora.

I get the error

Error: Gateway exgw: The server certificate is invalid. Please contact your IT administrator.

I checked if certificate is trusted

xxx\Downloads]$ trust list | grep Digi
label: DigiCert Global Root CA
label: DigiCert SHA2 Secure Server CA

The first two are the exactly the ones that are trusted.

I am puzzled. Did anybody have issues with Global Protect on linux ?

BPry — Wed, 31 Oct 2018 20:33:56 GMT

Are you actually sending the full chain, or are you only sending your Server certificate?

IPSonIE — Wed, 31 Oct 2018 20:57:59 GMT

Well,

Full chain is present on the firewall.

However, I did a lot of googling since I posted it.

I found this

And I believe this is an issue.

I can understand the software is supported on 3 distros of Linux, but technically Fedora is Redhat.

I am going to try Global Protect on Centos next and if it will work without me changing a single line of configuration on Palo Alto that will be it.

Rajesh12 — Thu, 01 Nov 2018 06:10:30 GMT

Yes, as per PA it supports below three types of Linux distributions only.

I do have 3rd party CA signed cert configured and tested it on both Ubuntu and RHEL. It works smoothly without any issues.