client cert invalid message when connecting global protect with client cert

[KiCheon.Lee]

Hello

I had tested to connect global protect with client cert successful in my lab.(PANOS-5.0.x)

I am installing global protect on my custom device.(PANOS-5.0.x)

But I don't connect with 'client cert invalid' message.

I had installed the following in my lab at old days.

1. self generated certificate.

2. subject > common-name. profile name is 'test'

3. Portal configuration (authentication profile : local DB , client certificate : none , certificate profile : none)

4. Gateway configuration (authentication profile : none , certificate profile : 'test')

5. import certificate into my laptop.

6. connecting GP -> portal auth localdb(id/pw) successful -> gateway auth client cert(username : uquest) successful

I am installing the following in my custom device.

1. FW is imported certificate issuer by window CA server.

   subject : /C=KR/ST=Seoul/O=paloalto/OU=paloalto/CN=pa.paloalto.co.kr

   issuer : /DC=local/DC=paloalto/CN=paloalto-CA

2. certificate profile : name 'test01'

    username field - subject  - common name

    domain : pa.paloalto.co.kr

3. Portal configuration (authentication profile local DB , client certificate : none , certificate profile : none)

4. Gateway configuration (authentication profile : none , certificate profile : 'test01')

5. import certificate into my laptop.

6. connecting GP -> portal auth localdb(id/pw) successful -> gateway auth client cert(username : none) fail.

    Error message is client cert invalid.

I don't know what missed configuration and problem.

Please let me know resolved way.

Thanks.

[Gregoux]

did you see that https://live.paloaltonetworks.com/docs/DOC-1934

[Gregoux]

in step 3 3. Portal configuration (authentication profile local DB , client certificate : none , certificate profile : none)

you forgot certificat profile

[KiCheon.Lee]

Hello gregory.screve1,

Thank you for your help.

I had seen this document your recommend.

I have modified certificate profile in portal configuration.

But I don't still connect GP with same error message.

Please let me know other resolved way.

[VinceM]

In your portal config / Client Configuration, Have you well configure your Trusted root CA ?

Have you got either error or warning during commit ?

V.

[Gregoux]

see https://live.paloaltonetworks.com/message/26851#26851

If you use a self-signed or in-house cert, this feature prevents the client from getting an 'untrusted issuer' prompt when connecting to that gateway. If you are using a public CA with your gateway, you won't need to use this feature.

you need to define the CA root like that only if you use a trust  root Ca that is not deployed on your client machine.

even you need it it doesn't block yours connection attempt, just a warning.

[KiCheon.Lee]

Hello VinceM,

Thank you for your information.

I have installed to choose client certificate in portal config / Client configuration / Trust Root CA.

But result is same. I don't connect GP with same error message.

I guess that FW does not read common name in certificate.

[KiCheon.Lee]

I had imported intermediate certificate for client certificate to FW.

My customer sent only this certificate issuer by private Window CA.

Do I need root certificate? Then Will I have to configure root certificate in portal config / Client configuration / Trust Root CA????

[Gregoux]

I think you have to chain the certificat on the paloalto

see https://live.paloaltonetworks.com/docs/DOC-1937

page 32 you could find an example to chain the certificat

and on your device you need to install the trust root CA and the intermediate

you could obtain more information about your issue if you activate the troubleshooting on the global protect agent on your user device.