Certificate Error in Global Protect Portal

[smithkopel]

Hi All,

I'm trying to setup the Globalprotect VPN and have followed the (only partially helpful) GlobalProtect-Configuration-4.1.pdf to create certs and set everything up. When I try to connect to the portal site with my browser I get a certificate error - "Error code: sec_error_bad_signature".

It doesn't matter if I conect to the host name or the IP that I defined in the cert, I still get this error.

Does anyone know what the problem could be. Also, is there a way to actually see the certificates?

Thanks,

Kenton

[smithkopel]

Thanks @mbehlok, that helped a bit, now I get a 404 error saying /uro/ was not found on this server. Must be more that I'm missing inthe setup I guess. Any thoughts?

[jambulo]

I too am getting this same error.  I followed the document "GlobalProtect Configuration for 4.1" as much as I could.  My Portal/Gateway does not have a FQDN, just an IP address.

Edit: Importing the Global Protect Gateway Cert allows my browser to reach the portal.  BUT, I can not log in, and I get a message on the portal saying "Invalid client certificate".

[ekerstetter]

I had a similar issue. I would get a certificate malformed error when trying to connect to the portal. I deleted all the certificates and started over. I was using underscores in the name for each certificate, I changed this to hyphens and made sure to fill out all the fields and it seemed to resolve the issue. Not sure why it did however and there is a chance that I had changed something else unknowingly during the process. It’s worth a shot I guess…

[Ovan]

Does anyone succeed in configuring Globalprotect with OS 4.1 ? please help sharing !!!!!

[mbehlok]

Ovan,

I actually got it to work, and it seems to work very well, at least once I got the certificates to work.

What can I do to help?  I can post up part of the configuration if that will help, or even some screen shots of the GUI.

Or if you want, get me access to the firewall if its in a lab environment and I can see if I can help out.

my direct email is mbehlok (at) sslmeetings.com

BTW, GP 1.1.2 is out, give that client a try as well as it seems to work better for me.