Global Protect 1.1.7

[panos]

Hi,

when we use this new version and with out wildcard certificate it gives an error.Can't we use wildcard cert with GP 1.1.7 ?

Thanks.

[gwesson · Accepted solution]

The Wildcard certificate itself may not be the issue. Was the wildcard certificate signed by a Certificate Authority trusted by your clients? There was a change with Global Protect 1.1.7. The following is the 1.1.7 announcement regarding the change to the way certificates are handled:

GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate.

The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match.

Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN. If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error.

If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues.

Refer to the following tech note for details on configuring server certificates: https://live.paloaltonetworks.com/docs/DOC-2020

Regards,

Greg Wesson

[panos]

Thank you for quick answer.issue is resolved up to your advice.

[kevin_thys]

Hi,

What is the config if using no client cert but only a CA generated on the PA and then a server cert signed by it?

I keep getting an error from the portal. "client cert error"

Regards,

Kevin