GP Server Certificate Verification Failed

Reply
Highlighted
L4 Transporter

GP Server Certificate Verification Failed

Hey guys,

 

I wanted to upgrade the Global Protect Version.

 

Currently, I have version 2.3.4 in use an everything works fine.

 

Now I have a new mac with 10.12 and therefore I need version 3.1.1 of GP.

 

So I activated it on the firewall, installed it on the mac 10.12 and now there's is an error:

 

"Server Certificate Verification Failed"

 

I'm not able to connect.

 

I found the "FQDN" thing on the internet. Indeed, I have the ip address in the External Gateway field.

 

But I had version 2.3.4 and it worked anyway.

 

So I'm not sure if this is my problem?

 

Thanks!

 

PAN OS: 7.0.7


Accepted Solutions
Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

Global Protect version 3.1.5 solved my problem.

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: GP Server Certificate Verification Failed

It's a known issue with the 2.3.x where it didn't really care and didn't complain about it. Just a side not on this as well I'm pretty sure you just broke GP. 3.1.1 requires the portal to be running PANos 7.1 or higher, since your running 7.0.7 this isn't going to work anyways so that may very well be your issue. 

 

I'm not all that sure that you need 3.1.1 to run GP on 10.12; I've got 3.0.3 running on our main GP and it connects to my iMac running the latest macOS perfectly fine. 

Highlighted
L2 Linker

Re: GP Server Certificate Verification Failed

The certificate CN and the external GP gateway match as IP and IP / FQDN and FQDN?

 

- Peter

Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

@BPry

Where can I find the information that GP 3.1.1 requires PAN OS 7.1 or higher?

 

Okay, so I will try GP 3.0.3

 

GP 3.0.3 doesn't require PAN OS 7.1?

 

 

But the whole thing is strange.

 

So I activated GP 3.1.1 on my PAN OS 7.0.7 PA-3020.

 

My other devices (Windows 7, Windows 10, Mac os x 10.11) all work fine.

 

They did the automatic client upgrade from 2.3.4 to 3.1.1

 

So I mean they work, although I have PAN OS 7.0.7 ?!

 

But why does my mac with 10.12 doesn't connect.

 

I don't know what to do now..

 

 

@sullivanpj2

What do you exactly mean?

Highlighted
L2 Linker

Re: GP Server Certificate Verification Failed

There's a "newer" verififcation check that PA added into GP (sometime in OS 2) that checks if the common name of the certificate and the globalprotect gateway match as IP or FQDN. For whatever reason, even if your DNS can resolve the FQDN, the PA will not allow them to be different. Here's the article but this is almost always what Server Certificate Verification Failed points too.

 

 

https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-Gateway-Certificate-Error-Whe...

 

Double check these settings and let us know!

 

- Peter

Highlighted
L7 Applicator

Re: GP Server Certificate Verification Failed

@sullivanpj2 the additional verification setup had already been enabled on 2.3.4 if memory serves correctly; good thing to check and make sure that it was actually setup correctly though. 

 

 

@MPI-AE You can find the release notes either on device under the 'Device' tab, going to globalprotect client and then on the right where it actually gives you the option to download and activate the software package it actually has a 'release notes' link that will bring you directly to that software version's release notes. Alternatively they are available on the support.paloaltonetwork.com site under the Software Updates section. 

I believe that you can use any GP version until you hit 3.1.x with a portal running on PAN OS 7.0.x, but you should really check the release notes before you ever install a new GP agent or install a new software version on PAN devices. 

 

It's a possibility that the upgrades worked because it only upgrades the newer files, or in other words it does an 'incremental' update; GP doesn't actually fully reinstall itself when you update the client. Before you really start troubleshooting your mac client I really recommend getting on a supported agent for your GP portal version. 

Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

Okay you are right. I read the release notes and you need pan os 7.1 for GP 3.1.1

 

So I have to upgrade my firewall.

Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

So I upgraded my firewall to 7.1.7.

 

However, the mac with mac os x 10.12 still doesn't connect and says "Gateway Ext Gateway: Server Certificate Verification Failed.

 

My other clients all work fine:

 

- Windows 7

- Windows 10

- Mac os x 10.10

- Mac os x 10.11

 

So I'm wondering why only the mac with 10.12 is complaining?

 

 

PS: I have checked the CN in the certificate. We are using an ip address.

This ip address is also in the external gateway field of the Portal.

So that matches.

Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

PAN-OS 7.1.8 Addressed Issues

 

 PAN-73291

 

Fixed an issue where authentication failed for client certificates signed by a CA certificate that was not listed first in the Certificate Profile configured with client certificate authentication for GlobalProtect portals and gateways.

 

Is this my issue?

 

Highlighted
L4 Transporter

Re: GP Server Certificate Verification Failed

Global Protect version 3.1.5 solved my problem.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!