Certificate Error in GP

[SubaMuthuram]

Hi Team,

I am getting below error while try to connect to GP. 

When I am try to connect to the portal getting this error, any suggestions? before it was showing continue but not it is not showing. 

Usually it will give the option to proceed anyway but it is not giving that option. After Reinstallation it is giving that option. 

[kiwi]

Hi @SubaMuthuram ,

Did I understand it correctly ? After reinstalling GP your problem was resolved ?

Best,

-Kiwi.

[aleksandar.astardzhiev]

Hi @SubaMuthuram ,

It sounds that like under the portal, agent config you are using either the default value (or specifically set it) for the option "Allow User to Continue with Invalid Portal Server certificate"

As you can imagine from the name it will not allow users to continue with connection if they don't trust the portal certificate.

Now there is a "Catch 22" - this is GP agent behaviour config which GP agent will receive from the portal on his fist connection.

When you manually re-install the GP agent application its default behaviour is restored, which will allow you to continue if you don't trust portal certificate. Once you connect and get the portal config from the firewall any subsequent connection will fail - because agent is now instructed to not continue if portal cert is invalid.

As described on the following link you could control this setting during installation - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-apps/deploy-ap...

This way even the very first connection to portal will fail, because after installation agent default behaviour will be "don't proceed if cert is invalid"

[SubaMuthuram]

Hi @aleksandar.astardzhiev ,

Great thanks for the clear info. that clears the lot. 

[SubaMuthuram]

Hi @kiwi ,

You you are correct, After reinstalling the client it is working fine. 

[SubaMuthuram]

HI @aleksandar.astardzhiev ,

If I make "Allow users to continue with Invalid server certificate" to yes will my issue resolve ? 

[aleksandar.astardzhiev · Accepted solution]

Hey @SubaMuthuram ,

Yes, but you will need to re-install GP agent again. Because you are in the "catch 22" right now - in order for the GP agent to get the new setting it needs to connect to GP portal, but it cannot because it still has the old setting which will not allow it to proceed with invalid certificate.

- Set "allow users to continue..." to yes under GP portal settings

- Re-install the GP to get the default behaviour and allow you to continue with invalid cert

- Any subsequent connection should allow you to continue with invalid cert

Although the above will definately solve your problem, I must say the proper way would be to use valid certificate which GP agent trust and leave the setting with default value of no (to block users connecting to portal with invalid certifcate), to prevent any possible man-in-the-middle.

[dmifsud]

Hi @aleksandar.astardzhiev,

That setting can also be deployed in the registry without reinstalling GP:

User Behavior Options (paloaltonetworks.com)

PORTAL AGENT CONFIGURATION	WINDOWS REGISTRY/ MACOS PLIST	MSIEXEC PARAMETER	DEFAULT
Allow User to Continue with Invalid Portal Server Certificate	can-continue-if-portal-cert-invalid yes | no	CANCONTINUEIFPORTALCERT INVALID= ”yes | no”	yes

Regards,

- DM

[aleksandar.astardzhiev]

Hi @dmifsud ,

That is interesting...Are you sure GlobalProtect will honor the registry key if it has already have connected at least once to GP portal and received settings from the portal?

From my personal experience I got the impression registry is used only after agent deployment and once it connect to portal it will get settings from the portal and for any subsequent connection it will ignore changes in the registry keys.

I  haven't tested to change that specific settings (allow users to continue with invalid cert), but a while ago I tried to change the portal settings refresh timer. We previously had configured portal refresh every 8 hours. I wanted to set it to 2hours, but as you can imagine there were lots of users that didn't receive the new setting (always connecting to cached gateway and never get full 8 hours of connection to trigger portal refresh). So I tried to change the registry key for who were still using the old value, but none of them honored the registry.