topic wild card certificate. in General Topics

wild card certificate.

Jafar_Hussain — Thu, 03 Dec 2020 17:46:33 GMT

Dears,

i am using a wild card certificate for global protect. when i tried to connect global protect agent. i am facing the below issue:-

Certificate description:-

I have imported the wild card certificate that is sign by digicert.

firstly i have imported trusted root CA.

Then intermediate CA.

After that the server chain certificate.

Configuration description:-

I have used root CA and intermediate CA in a local trusted root certificate store.

And the server certificate we are using in SSL/TLS profile.

PAN-OS version - 8.1.11

GP version - 5.1.0

I have just a question:-

is there any limitation for a subdomain in the wild card certificate?

example:- i am using the domain "abc.vpn.contoso.com.uk"

Appreciate your response.

Re: wild card certificate.

rmfalconer — Thu, 03 Dec 2020 23:48:00 GMT

What's the CN on the cert? If it's *.contoso.co.uk, it won't work. You would need *.vpn.contoso.co.uk.

This isn't a limitation of GP, it's the behavior with any certificate.

Re: wild card certificate.

Mick_Ball — Fri, 04 Dec 2020 02:54:42 GMT

Hmmmm... seems a bit odd that you are offered a gateway in the first place. I assume you had no certificate error for the portal... do you get an error if you browse https to your portal?

Re: wild card certificate.

Jafar_Hussain — Fri, 04 Dec 2020 20:00:55 GMT

@rmfalconer

The CN on the cert is *.contoso.com.uk. and the gateway URL is *.abc.vpn.contoso.com.uk. as per your suggestion would i need to change the common of the certificate like *.vpn.contoso.co.uk?

Re: wild card certificate.

rmfalconer — Fri, 04 Dec 2020 21:15:45 GMT

Let's say the url is 1.abc.vpn.contoso.co.uk, then you would need a wildcard for *.abc.vpn.contoso.co.uk.

*.vpn.contoso.co.uk would not work for 1.abc.vpn.contoso.co.uk

The * only functions at one level.

Re: wild card certificate.

Jafar_Hussain — Sat, 05 Dec 2020 17:31:36 GMT

@rmfalconer

Thanks for the detail. i will change the CN name.

Then i will try.