Cannot install Machine Certificate for GP Pre-logon

[FarzanaMustafa]

I encountered a problem installing the machine certificate.

I followed the article below:

https://live.paloaltonetworks.com/t5/news/globalprotect-pre-logon-authentication/ta-p/322237

We are using a self-signed root ca that is in the cert profile for auth, then generated the server cert and machine cert and signed them with the same root. Then export as pks12.

In the Certificate Profile, I changed the Username Field type from 'None' to 'Subj'.

Made sure I selected the Computer account (default is user account) and cert is in folder "Personal" there.

Tried the MS fix but no luck.

https://social.technet.microsoft.com/Forums/en-US/50bd9c7c-faaa-46e3-b9a4-a2bb885b180d/unable-to-imp...

Please help!

[MickBall]

something seems to be wrong with your configuration as when I log off my workstation the existing (not previous) connection changes to pre-logon and reverts to my name when i log back in.

can you post exactly what you have in the gateway config...

[MickBall]

[FarzanaMustafa]

Thank you so much for your guidance.

I checked the GP GW config and removed the cert from Certificate Profile. It worked!

May I ask what was the problem?

[MickBall · Accepted solution]

I cannot really tell without seeing your complete setup but it may be that as you included the certificate in the profile, GP was seeing pre-logon as a separate user rather than just a pre-logon user.