topic Re: My Global protect VPN certificate is expiring soon. How to renew it in General Topics

My Global protect VPN certificate is expiring soon. How to renew it

shafi021 — Thu, 14 May 2020 14:22:42 GMT

My Global protect VPN certificate is expiring soon. How to renew the certificate. System engineer provider me certificate in .p12 format. This is my first time to do cert renewal. Please guide me. Thank you.

Re: My Global protect VPN certificate is expiring soon. How to renew it

shafi021 — Thu, 14 May 2020 14:25:38 GMT

@OwenFuller can you please help me on this 🙂

Re: My Global protect VPN certificate is expiring soon. How to renew it

OwenFuller — Thu, 14 May 2020 14:40:13 GMT

I assume you mean the portal/gateway server certificate is expiring. You should be able to go to Device > Certificates > Import. From there you can select "Encrypted Private Key and Certificate (PCKS12) from the File Format drop-down menu. You'll need the password used by the sysadmin to encrypt the certificate as well.

Once you've imported the new certificate, you'll want to go to Device > SSL/TLS Service Profile, open whichever SSL/TLS profile is used on your GlobalProtect gateway/portal, and select your new cert in the certificate drop-down.

Re: My Global protect VPN certificate is expiring soon. How to renew it

shafi021 — Thu, 14 May 2020 14:46:15 GMT

Yes, I have password for cert. Thanks Owen. You are so helpful.

Re: My Global protect VPN certificate is expiring soon. How to renew it

shafi021 — Thu, 14 May 2020 15:10:34 GMT

@OwenFuller My existing cert name is 'MyCompanyName'. I want to use same name 'MyCompanyName' for new cert, so do I need to revoke old 'MyCompanyName' cert first and then import the new cert with same name? I have scheduled maintenance window.

Re: My Global protect VPN certificate is expiring soon. How to renew it

OwenFuller — Thu, 14 May 2020 15:16:29 GMT

Personally, I would wait to revoke the other certificate until you have the new certificate imported and tested, just in case you have to roll back your changes, but that's just my opinion. If you go this route, you'll need to give them different names. You can rename the old one, or give the new one a different name like MyCompanyName-2020-2021 for the dates the certificate is valid. Whatever you want, just so they are different.

Re: My Global protect VPN certificate is expiring soon. How to renew it

shafi021 — Thu, 14 May 2020 15:26:36 GMT

I agree with you. Thanks a lot.

Re: My Global protect VPN certificate is expiring soon. How to renew it

ITCoordinator — Sun, 20 Feb 2022 07:38:06 GMT

Hi OwenFuller,

I'm also the first time to renew our GP VPN device certificates. But my certificates just expired today.

And I checked our old device certificates, it doesn't have the "CA".

When I renew it, do I need to import certificates ".pem" file or "pkcs12"? I don't want to change any current VPN configuration.

I have totally no idea how to do it. Thanks a lot!

Re: My Global protect VPN certificate is expiring soon. How to renew it

Kevin9722 — Mon, 21 Feb 2022 06:42:17 GMT

The solution worked for me thanks to the community and the members for the solution.

Re: My Global protect VPN certificate is expiring soon. How to renew it

D.Unroe — Tue, 18 Feb 2025 20:25:10 GMT

in addition to updating the cert in the above locations I found that I also needed to update it under the Agent Config for Authentication Override