Adding multiple client certificate in Linux GP agent

Abdul_Razaq — Tue, 07 Jul 2020 10:54:09 GMT

Hi Community,

I have a requirement to add multiple client certificate into Linux GP config. Usually, whe we put 'globalprotect import-certificate --location <cert_location>', the existing client cert will be overridden with the new one and it will be imported as pan_client_cert.pfx under /opt/paloaltonetworks/globalprotect .. Is there a way to keep both instead of override, so that i can use different client certificates while connecting to different portals. In windows, as it is taking from windows personal store, it will be discrete and we wont face this issue.

Anybody have any idea to achieve this ?.. or can we combine different .p12 files to single .pfx ?,

I am looking for some options other than adding both CAs in certificate profile

Thanks in advance!

Re: Adding multiple client certificate in Linux GP agent

Retired Member — Tue, 07 Jul 2020 14:52:29 GMT

Hello @Abdul_Razaq,

As far as I know there is a technical possibility to include multiple certificate chains and private keys in a PKCS #12 archive however it is not something widely implemented.

I see GlobalProtect App for Linux as an open-beta and assume what you require is beyond its abilities. Even basic verification of imported certificate is not performed:

$ globalprotect import-certificate --location /dev/zero Please input passcode: Import certificate is successful.

I would explore alternative VPN Client - OpenConnect. It claims compatibility with GlobalProtect: https://www.infradead.org/openconnect/globalprotect.html

Certificate for authentication is provided as command-line argument (https://www.infradead.org/openconnect/manual.html - -c,--certificate=CERT) so it can be easily selected per Portal/Gateway.

Not sure it will satisfy your other requirements, and it is a 3-rd party application introduction into environment, but might work.

Getting in touch with your SE to rise a Feature Request and wait like Sleeping Beauty for it to be kissed by a PM-Prince is also an option 😉

topic Adding multiple client certificate in Linux GP agent in General Topics

Adding multiple client certificate in Linux GP agent

Re: Adding multiple client certificate in Linux GP agent