Certificate trust error after updating Global protect client

[darren_g]

Folks.

I've finally managed to get approval to push out an update to the latest Global Protect client, but now when we connect, we get a certificate trust error. We are using a self-signed certificate for the portal.

I've applied the fix suggested in this Trusted root CA on Global Protect Portal post - but it hasn't helped.

Can anyone suggest other places I can look to fix this? Or do I need to bite the bullet and buy a proper certificate?

Thanks.

[_slv_]

Did You add your Root CA cert on workstation into Trusted Root CA folder?

In my opinion it is nessasary to workstation are able to validate your certiciate.

Regards

Slawek

[darren_g]

It's a self-signed certificate - there is no Root CA that I know of.

I'm buying a public certificate for the gateway - it's taking too much mucking around - but, as usual, PA's documentation on certificates is as confusing as hell, so I've given up trying to sort out the self-signed nonsense.

[_slv_]

If You used OpenSSL to generate cert You had to generate root ca first

https://langui.sh/2009/01/18/openssl-self-signed-ca/

I can recomandate free ssl cert from StartSSL

about doc's - the most important thing is to "glue"  intermediate cert with your cert - the rest is intuitive

Regards

Slawek

[darren_g]

I wish I'd known about StartSSL before I started mucking around with this.

No matter - the company has purchased a proper SSL certificate for the VPN portal, and all is well - except for the older client versions, which *still* complain about the certificate, forcing me to do a rather rushed upgrade. The current (1.2.7) client works just fine now, as does the portal page to download it from.

Cheers.