topic Re: Global Protect client certificate auth Current User Vs Local Computer Store in General Topics

Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 02:44:37 GMT

Having some trouble with a generalized single certificate (wanting to use as part of user/pass authentication) across multiple machines. Wanting to require this certificate be on a machine and the user enter their user/pass combination for authentication to portal/gateway (not user/machine specific cert). Not doing prelogon at this point. I can add this exported certificate into the Certificates (Local Computer) /Personal AND Trusted Root store ....all day long....and it makes no difference.

I can even specify in the portal agent config to use 1.3.6.1.5.5.7.3.2 for an OID- and also ensure that both Client certificate store look up - both "user and machine" is set on the portal...still nothing.

The only way I can get this to successfully work, is by placing the exported certificate into the Certificates -Current User - personal - store. ...then everything works perfectly. It's almost as if windows clients have issues accessing the machine store when a user is logged in? Anyone have experience with this, or something along these lines?

Maybe @Mick_Ball answered part of this already below:

https://live.paloaltonetworks.com/t5/General-Topics/Does-Pre-logon-for-Global-Protect-use-the-Computer-certificate/m-p/257139#M72945

MS seems to hint at the fact that any machine store cert in the trusted root will be mirrored to the current user store trusted root- but NOT the Current User Personal:

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores

"Be aware that all current user certificate stores except the Current User/Personal store inherit the contents of the local machine certificate stores."

Does a generic certificate have to be installed for every user under their current user personal certificate store?

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Thu, 14 Nov 2019 06:40:17 GMT

No, generic certificates do not have to be in the users personal store..

Have you set the GP app to use both user and computer certs.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 16:57:26 GMT

@Mick_Ball Are you referring to the "client certificate store lookup" - both user and machine ? - If so, yes, I have that specified. This is not for pre-logon- only when the user is logged on. Thank you for the quick reply. Never hurts to have more input.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Thu, 14 Nov 2019 17:05:35 GMT

OK worth a check..

I use certs in the computer store and it works fine for when users are logged into the device.

I also do not use pre-logon.

with the certificate located in the computer/personal/certificates area have you tried browsing vi IE to your portal.

this may throw up a more helpful error than the portal.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

rmfalconer — Thu, 14 Nov 2019 18:53:16 GMT

Access to the machine cert store is not available to standard user accounts. It requires elevated permissions. Not sure if GP can get around this if a user is already logged in to the machine.

@Mick_Ball , do your users have admin rights on the workstation?

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Thu, 14 Nov 2019 18:57:57 GMT

@rmfalconer , hi.

nope, admin level access is used to install the cert but our users are restricted to the hilt.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 21:41:57 GMT

Browsing to the Portal will throw the same error- "client certificate required"- it's like it doesn't see the cert at all....but the second I move it to the current user store---everything works....

I'm hearing that people have these certs in their machine stores, but I have yet to get this to successfully work

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 21:44:21 GMT

I am starting to wonder about this, as I cannot get it to successfully work

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 21:53:05 GMT

@Mick_Ball -

That certificate is not used for pre-logon, or installed in the personal store right?

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Thu, 14 Nov 2019 22:01:49 GMT

No the certificate is not in the users personal store.

for a small group of user, about 250, we cannot use the personal store. So we use the computer store.

i will check AD permissions tomorrow to see if @rmfalconer has seen something more obvious here.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Thu, 14 Nov 2019 22:06:12 GMT

@Mick_Ball

Thank you very much. Any help is appreciated.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Fri, 15 Nov 2019 06:12:58 GMT

Are you using the mmc certificate snap-in tool to import the certificate..

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Fri, 15 Nov 2019 13:37:31 GMT

Yes I am.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Fri, 15 Nov 2019 14:16:05 GMT

and are you running the snap-in on the users device or are you running this on your own device and connecting to another computer within the snap-in.you only need the generic cert on the device. the root cert stays on the firewall and in a cert profile.

below is a snippet of my store, does your machine store look similar.

perhaps also let me know from start to finish, including cert export format, exactly what you are doing.

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Fri, 15 Nov 2019 17:09:08 GMT

another question...

are you adding this additional auth via an auth profile additional factors or to the portal authentication tab (cert profile)

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Fri, 15 Nov 2019 19:14:59 GMT

I’m using the snap in on the machine that I am on(testing to ensure this works on my machine first). The ca cert is staying on the firewall, and the subservient cert is getting exported with its private key to the local computer store. I’m adding the cert profile through the portal authentication tab. So I have the regular ldap authentication in the main section, and then in the drop down below it I’m adding the cert profile that uses the ca of the exported (with private key)subservient certificate. The subservient cert is getting exported as pkcs12, with a password set on it. Is that the way it should be done?

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Fri, 15 Nov 2019 19:16:39 GMT

@Mick_Ball Impressed with your level of response here. Thank you

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Fri, 15 Nov 2019 20:01:43 GMT

Hey no problemo....

its a shame the messaging service is not working on this site as could send you one of my certs for you to test against my lab portal...

i have logged this as a fault so fingers crossed...

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Sec101 — Sat, 16 Nov 2019 00:22:05 GMT

I'm not sure I understand? yeah, i noticed this site's direct messaging appears broken...so you think it may be a certificate issue itself?

Re: Global Protect client certificate auth Current User Vs Local Computer Store

Mick_Ball — Sat, 16 Nov 2019 08:47:07 GMT

Not sure, kinda running out of ideas... at least that test would tell us if cert issue or windows issue.

going through post again...from the start did you generate a self signed root ca that is in the cert profile for auth, then generated the user cert and sign it with the same root. Then export as pks12.