topic Rename CN name certificate GlobalProtect . in General Topics

Rename CN name certificate GlobalProtect .

abdulhakam — Fri, 22 May 2020 03:12:16 GMT

Hi Team,

I have question, currently, on firewall PA-500, we do 2 gateway VPN. Its mean have 2 WAN(ISP). So few users will use VPN via WAN1, and few users will use VPN via WAN2. Existing VPN using WAN1. So certificate CN name(IP address) point to Gateway WAN1. after added WAN2 and new gateway from WAN2. We notice have certificate mismatch when users try to connect GP VPN IP gateway WAN2.

So if I rename CN name of certificate from IP ADDRESS TO FQDN, have any charge from Palo Alto.? Or free to rename. not need to pay.?

Thanks.

Re: Rename CN name certificate GlobalProtect .

SutareMayur — Fri, 22 May 2020 05:49:41 GMT

@abdulhakam ,

It seems you are using Palo Alto self signed certificate for your GP VPN. For VPN 2, you can generate new certificate and use it in new ssl profile. This profile can be used for VPN2.

If you are trying to change CN of existing self signed certificate, may be system won't allow you to change it. Best way is to generate new cert and use it for VPN2.

There shouldn't be any cost or charges involved in this.

Hope it helps!

Mayur

Re: Rename CN name certificate GlobalProtect .

abdulhakam — Tue, 26 May 2020 07:13:23 GMT

Hi @SutareMayur

Thanks For Answer,

Yes, I can't rename the CN existing. I will generate new certificate and CN name will be FQDN not IP Address.

It will work if i have using two gateway(VPN1 and VPN2) using CN name FQDN.?

Thanks

Re: Rename CN name certificate GlobalProtect .

SutareMayur — Tue, 26 May 2020 07:55:08 GMT

@abdulhakam ,

Yes it will work using certificate which is generated for FQDN as well. If you are using FQDN to connect GP then that certificate will get accepted and trust will be build. If you are using IP address to connect GP and certificate used is generated for CN as FQDN then there will be mismatch. So you need to check in this regard also.

Mayur

Re: Rename CN name certificate GlobalProtect .

abdulhakam — Mon, 08 Jun 2020 08:21:27 GMT

Hi @SutareMayur ,

"Best way is to generate new cert and use it for VPN2."

U mean generate new cert and setup same like existing cert. I mean setup From A to Z..

like this https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK

Re: Rename CN name certificate GlobalProtect .

SutareMayur — Tue, 09 Jun 2020 04:47:34 GMT

@abdulhakam,

Yes, you can generate new certificate on Palo Alto. Then create new SSL/TLS profile and map that certificate in it. You can use this SSL/TLS profile for VPN2.

Mayur