Certificate Error in Global Protect Portal

[smithkopel]

Hi All,

I'm trying to setup the Globalprotect VPN and have followed the (only partially helpful) GlobalProtect-Configuration-4.1.pdf to create certs and set everything up. When I try to connect to the portal site with my browser I get a certificate error - "Error code: sec_error_bad_signature".

It doesn't matter if I conect to the host name or the IP that I defined in the cert, I still get this error.

Does anyone know what the problem could be. Also, is there a way to actually see the certificates?

Thanks,

Kenton

[Ovan]

Thanks mbehlok,

please help to post up your configuration guide with screenshots. I followed the " Configuring GlobalProtect 4.1 guide" But i didn't work.

[jambulo]

So I finally got Global Protect to work on 4.1.2.  Following the "Configuring GlobalProtect" guide won't get you anywhere.  Apparently using the Palo Alto as a CA server does not work  So the steps in the guide where it tells you to create a CA cert, and then the 2 other certs, do not apply.  I had a Palo Alto Support Engineer take a look at our setup.  What he did to make it work...

1) Generate a plain Cert in Palo Alto(Not signed and not a Certificate Authority)

2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None".  Set "Server Certificate" to the Cert you made in step 1.

3) Move to Client Configuration tab > Delete any Root CA's that are set.

4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you created in step 1.  Set "Client Certificate Profile to "None".

[mbehlok]

Thanks for the update Jambulo.

I was actually able to get it to work by using the PA as the CA server.

I did have to upload the CA Cert and the Client certs to my client though in order for the client to connect, before that I kept getting cert errors.

I am on 4.1.2 PanOS and GP 1.1.2.

Glad you got it working though.

[smithkopel]

Using a single certificate also worked for me. I had an SE come in and go through all my configuration stuff and still ran into the same error. When we did it using the single cert, everything worked fine. Since the cert is only to secure the portal to login and get the client, a single certificate should be sufficient. This also means you don't have to install the client and root cert on every machine that is going to connect to the portal. This would also enable you to use a third-party web certificate to avoid the cert error on connecting to the portal.

Thanks everyone for your help.

Of course, none of this stuff negates the fact that the documentation for this whole process is bad and in many cases just plain wrong. I'm finding that this is a trend in the Palo Alto documentation.

[kamish]

This is an interesting thread.  I have been using GP since the original release.  I agree that the guide is very vague and doesn't help much.

Attached are screen shots of my config with OS 4.1.2 and GP client 1.1.2-9 and all works well.  We use a root CA and sign all of the server and client certs with the CA.

Hope this helps.