Any idea about 3rd party verisign certificate with GlobalProtect ?

[panos]

We were using sslvpn with PA 's certificate.Now we bought 3rd party cert. from Verisign and imported it as using server certificate

But Global Protect gives an error as "Protocol Error: Check server sertificate"

I have searched KnowledgePoint but could not find anything for this error.

Any idea ?

[cmateam]

I think I've had the same problem.  PAN's documentation, and what others tell you to do is inaccurate. I happened to stumble on this forum thread, https://live.paloaltonetworks.com/thread/4054 and found this answer to be very helpful instead of generating a plain cert on the PA-FW, use your purchased cert instead:

1) Generate a plain Cert in Palo Alto(Not signed and not a Certificate Authority)
2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None".  Set "Server Certificate" to the Cert you made in step 1.
3) Move to Client Configuration tab > Delete any Root CA's that are set.
4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you created in step 1.  Set "Client Certificate Profile to "None".

I was getting a very similar error doing it any other way, but this seemed to fix the problem.

[panos]

Thanks for help but where is the cert that I have bought ? I could not find it at your answer.

[cmateam]

This is typically provided to you either by an email or at time of purchase through the web browser.  You would save it to notepad and save it to a .crt file.  Then you upload the cert to Device->Certificates

[panos · Accepted solution]

I know that.I have the file already.You mean the solution is like this :

1) Upload cert. you bought

2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None".  Set "Server Certificate" to the Cert  you uploaded

3) Move to Client Configuration tab > Delete any Root CA's that are set.

4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you uploaded. Set "Client Certificate Profile to "None".

is this the solution ? Because I will try it tomorrow

[cmateam]

Correct.  Assuming that is what you are trying to accomplish.  Presenting the VPN portal in a way that does not give a certificate warning.

[panos]

Thanks.I will try and write back.Thank you.

[panos]

I tried that.Not selecting any client certificate fixed the problem.Thank you very much.

I wonder if we want to use client certificate also, what steps will we do.

Thank you for help

[cmateam]

The Client cert depends on how you want to setup that. We use AD in our environment, so we generate user certificates from our AD CA.  You can generate a signed cert within the PA too and use that.

[panos]

ok.I understand AD.

can we use the certificate that we bought for clients also ?(it is wildcard cert)

[cmateam]

You may be able to, but I don't know how to configure that.  We used AD CA certs, it was easier.  To sign individual certs with the purchased one, I don't think you can do that.

[SistemasCajamar]

Hello

How did you generate user certificates from AD?

Which template did you use?

Did you generate a Gateway Certificate too?

Thanks

[cmateam]

User certificates were created from Window's Server Cert Authority - we obtain user certs this way https://domaincontroller/certsrv since that is where our certificate authority is as the moment. If you are logged in with the user then they just simply walk through the process and it add's it to their machine.

I'm not sure I understand the Gateway cert question, we generated a third party cert and specified both in the portal / gateway this cert for our server cert. I also had to use our internal root cert to handle the user cert authentication.

[SistemasCajamar]

Hello

My question is about the type of certificate you have to issue as there are several templates on the Windows CA

[cmateam]

I believe all you need is a user certificate.  When going to the certsrv in a web browser, logging in with the user name/password - for us just generates a user certificate.