Captive Portal SSL Certificate Error

[networkadmin]

We're running 5.0.10 with Captive Portal.

We have an SSL certificate installed for *.domain.com and have several internal DNS entries that point something.domain.com to various physical interfaces on the Palo Alto.

We recently revoked and rekeyed our wildcard cert and since importing and replacing all instances with the new certificate, on some machines (not all), when getting to the captive portal there is a "Don't recognise the CA" error thrown up by Internet Explorer with Chrome simply saying "No Connection".

In the PAN GUI the certificate shows as being issued by AlphSSL, which it was.  On machines with the error I can get to the management interface which uses the same certificate and I don't get any kind of error.

I'm a little confused - the only thing I can imagine is if I need to somehow get the intermediate onto the PAN, but that would seem unlikely since the management interface works perfectly using the same certificate.

[sjamaluddin · Accepted solution]

You would have to ensure that the entire certificate chain (in your case the intermediate) that may have been used to sign the server certificate is imported onto the PAN firewall.

Under the following tab:

Network>>Global Protect>>Portal>> Client Config where it says "Root CA" - please include the requisite certificates to complete the certificate chain if they are in the PAN firewall, you can use the drop down.

HTH

[networkadmin]

Thanks, looks like importing with the intermediate appended fixed it