Adding multiple client certificate in Linux GP agent

[Abdul_Razaq]

Hi Community,

I have a requirement to add multiple client certificate into Linux GP config. Usually, whe we put 'globalprotect import-certificate --location <cert_location>', the existing client cert will be overridden with the new one and it will be imported as pan_client_cert.pfx under /opt/paloaltonetworks/globalprotect .. Is there a way to keep both instead of override, so that i can use different client certificates while connecting to different portals. In windows, as it is taking from windows personal store, it will be discrete and we wont face this issue.

Anybody have any idea to achieve this ?.. or can we combine different .p12 files to single .pfx ?, 

I am looking for some options other than adding both CAs in certificate profile

Thanks in advance!

[ACieszkowski]

Hello @Abdul_Razaq,

As far as I know there is a technical possibility to include multiple certificate chains and private keys in a PKCS #12 archive however it is not something widely implemented.

I see GlobalProtect App for Linux as an open-beta and assume what you require is beyond its abilities. Even basic verification of imported certificate is not performed:

$ globalprotect import-certificate --location /dev/zero
Please input passcode:
Import certificate is successful.

I would explore alternative VPN Client - OpenConnect. It claims compatibility with GlobalProtect: https://www.infradead.org/openconnect/globalprotect.html

Certificate for authentication is provided as command-line argument (https://www.infradead.org/openconnect/manual.html - -c,--certificate=CERT) so it can be easily selected per Portal/Gateway.

Not sure it will satisfy your other requirements, and it is a 3-rd party application introduction into environment, but might work.

Getting in touch with your SE to rise a Feature Request and wait like Sleeping Beauty for it to be kissed by a PM-Prince is also an option 😉