Certificate Error in Global Protect Portal

Showing results for 
Search instead for 
Did you mean: 

Certificate Error in Global Protect Portal

Not applicable

Hi All,

I'm trying to setup the Globalprotect VPN and have followed the (only partially helpful) GlobalProtect-Configuration-4.1.pdf to create certs and set everything up. When I try to connect to the portal site with my browser I get a certificate error - "Error code: sec_error_bad_signature".

It doesn't matter if I conect to the host name or the IP that I defined in the cert, I still get this error.

Does anyone know what the problem could be. Also, is there a way to actually see the certificates?




Thanks mbehlok,

please help to post up your configuration guide with screenshots. I followed the " Configuring GlobalProtect 4.1 guide" But i didn't work.

So I finally got Global Protect to work on 4.1.2.  Following the "Configuring GlobalProtect" guide won't get you anywhere.  Apparently using the Palo Alto as a CA server does not work  So the steps in the guide where it tells you to create a CA cert, and then the 2 other certs, do not apply.  I had a Palo Alto Support Engineer take a look at our setup.  What he did to make it work...

1) Generate a plain Cert in Palo Alto(Not signed and not a Certificate Authority)

2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None".  Set "Server Certificate" to the Cert you made in step 1.

3) Move to Client Configuration tab > Delete any Root CA's that are set.

4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you created in step 1.  Set "Client Certificate Profile to "None".

Thanks for the update Jambulo.

I was actually able to get it to work by using the PA as the CA server.

I did have to upload the CA Cert and the Client certs to my client though in order for the client to connect, before that I kept getting cert errors.

I am on 4.1.2 PanOS and GP 1.1.2.

Glad you got it working though.

Using a single certificate also worked for me. I had an SE come in and go through all my configuration stuff and still ran into the same error. When we did it using the single cert, everything worked fine. Since the cert is only to secure the portal to login and get the client, a single certificate should be sufficient. This also means you don't have to install the client and root cert on every machine that is going to connect to the portal. This would also enable you to use a third-party web certificate to avoid the cert error on connecting to the portal.

Thanks everyone for your help.

Of course, none of this stuff negates the fact that the documentation for this whole process is bad and in many cases just plain wrong. I'm finding that this is a trend in the Palo Alto documentation.

L3 Networker

This is an interesting thread.  I have been using GP since the original release.  I agree that the guide is very vague and doesn't help much.

Attached are screen shots of my config with OS 4.1.2 and GP client 1.1.2-9 and all works well.  We use a root CA and sign all of the server and client certs with the CA.

Hope this helps.

Hi Kamish,

Thanks very much. I've been working away on this for hours before seeing you post. My last issue was the temptation to select a value for Client Certificate Profile in the Portal Config. Please also note that after I recreated all the certs and started again, I emptied my test client browser cache and purged the certs from the cert personal store.

Works nicely now with PA based CA cert.

@kamish do you then manually copy the certificates to the browsers on the machines that need to connect to the portal?


Palo Alto Networks Guru

Using GlobalProtect with an external CA could be documented better I suppose. The most common mistake is that the certificate that is issued by the external CA is not imported back into PANOS together with the corresponding private key and certificate chain. Usually you'd import it as a PKCS12 file.

@mwalter my initial problems were not with a third-party CA. I was using the PA as the CA exactly as per the instructions and it still didn't work, even after sitting down with an SE. It wasn't until we did the single cert solution as documented in this thread that we were able to get it working.

@jambulo: Thanks!  Works for me...

I wonder if PaloAlto is willing to change the documentation if its wrong or outdated.  Otherwise, we are all following the wrong documentations.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!