Global protect certificate

[infotech]

What are the steps to apply a 3rd party certificate to a global protect client instead of using a self signed cert?

[VinceM]

Hi,

Import both your public cert authority and your certificate CA in your palo.

Then use your CA in authent profile.

V.

[VinceM]

Hi,

Refer to: GlobalProtect Administrator's Guide 6.0 (English)

V.

[infotech]

I will check this out

[infotech]

By public you mean a cert purchased by a 3rd party and I don't believe we have a CA server

[HULK]

Few more reference DOC:

PAN SSL Certificates

Global_Protect_PAN_OS5.pdf

Hope this helps.

Thanks

[infotech]

Good information thanks. We currently have a self signed cert for our global protect and I want to change it to a third party. I assume it only has to be imported to the PA device and does not have to be on a pc that has the GP client installed

[HULK]

Yes, that is correct. During the SSL handshake, PAN will push the certificate information to the client.

GlobalProtect

Thanks

[infotech]

This is what is currently configured

[_slv_]

Hi Infotech

You will; be probablyh faced with intermediary cert problem, so here You are solution:

How to Install a Chained Certificate Signed by a Public CA

Regards

SLawek

[infotech]

This looks like instrucations on how to install it on a server

[_slv_]

yes, PAN is a server for GP, please follow Importing Chained PEM Format Certificates - Using Text Editor and import Your cert into PAN.

You can verify is that properly configured using SSL Checker - SSL Certificate Verify

Regards

Slaweke

[infotech]

So you have to do like for any server that has a cert on it export the existing key, send it to a 3rd party vendor,get anothe key and import it onto the PA

[infotech]

I think this link I found inside one of the responses is what I really need

How to Generate a CSR(Certificate Signing Request) and Import the Signed Certificate

[infotech]

What do you put that FQDN?