12-05-2017 02:04 PM
Hi
Anyone run into a issue where Client Certificate does not get presented to GP if its in the Local Machine Store? I tired giving the user perm but this didnt fix it. Only way to resolve it is to move the cert to the user store, which I dont want to do.
Thaks
02-13-2019 04:09 PM
We generate machine certs and user certs, both scoped to specific AD groups. We use certs for more than just VPN so we have a need to deploy both.
02-13-2019 10:24 PM
I do not use pre logon, it doesn’t really suit our requitements.
I use both pki and self signed.
pki user certs go into user store for globalprotect.
pki machine certs go into machine store for network access control.
self signed certs are distributed to 3rd party support and non domain maccy stuff.....
one thing i have noticed is that our machine certs cannot be used for gp as the cert profile is looking for subject field and the machine certs do not contain this information. Perhaps thats your issue...
02-21-2019 09:58 AM
Just a follow up as I opened up a TAC case for this issue. It turns out that the version of PanOS we are on 8.0.13 does not support SHA512, which is what our internal PKI CAs are hashed with.
08-19-2020 05:33 AM
Did you upgrade OS , just to know if that fixed your issue ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
