topic Re: Certificate error in Globalprotect app in Android in General Topics

Certificate error in Globalprotect app in Android

DptoInformatica — Tue, 08 Oct 2019 12:44:48 GMT

Hi,

I have created a Portal and gateway for globalpotect connections.

I have assigned a Wildcard certificates for the connection.

In all my computers and iOS devices the connection is perfect but in Android devices have the message "The server certificate is not valid."

Do you know what may be happening?

Thanks,

Re: Certificate error in Globalprotect app in Android

S.Cantwell — Wed, 09 Oct 2019 01:54:52 GMT

This would be a tough issue to explain.

It appears that Android does not trust the certificate or the trusted certificate that signed your cert.

I am presuming it wasa publicly signed cert, versus a wild card cert, signed by your internal/enterprise certificate authority.

As a test, I would recommend that you manually export the cert, from the firewall, and import into the Android device, as a trusted certificate. Now, when the wildcard is presented by the portal or gateway, it would be accepted.

I just do not believe that the issue is a misconfiguration on the FW, because the error comes from Android OS.

Re: Certificate error in Globalprotect app in Android

OwenFuller — Tue, 31 Mar 2020 15:11:53 GMT

Hey @DptoInformatica, I know this is about 5 months old, but I was curious if you found a fix for this.

Re: Certificate error in Globalprotect app in Android

S.Cantwell — Wed, 01 Apr 2020 14:25:11 GMT

I think I found the issue and it is really straight forward.

Under the Portal Config, go to the Agent Tab, and ensure that the Trusted Root CA is there, AND Install in Local Certificate Store.

Steve

Re: Certificate error in Globalprotect app in Android

OwenFuller — Fri, 03 Apr 2020 14:13:47 GMT

Interesting. We're using a cert signed by Digicert for our portal, so I had assumed this wasn't necessary. I may have to give it a try though. Thanks.

Re: Certificate error in Globalprotect app in Android

ostockhamm — Wed, 15 Apr 2020 19:10:47 GMT

I validated that for samsung galaxy android devices, the gateway certificate needs to be installed locally in the user certificate store and installed for vpn and apps...hope this helps.

This goes for both publically and privately signed certificates for the gateway. Only applies to the android client as far as i can tell. Running client 5.1.1.

Re: Certificate error in Globalprotect app in Android

Simone.Colpi — Mon, 08 Jun 2020 11:44:48 GMT

Hello I have the same problem with one customer of mine, he has a certificate signed by Digicert.

I have partially solved redirecting gateway requests by android devices toward a Gateway with a self signed certificate and pushing the CA into the client. But now I have a new problem, all android devices are ok, but a few (not all) windows devices have certificate problem, it seems as some windows devices are seen as android devices.....