Global Protect - Linux Fedora , CA trusted cert error

[PiankaMariusz]

Hi There,

I'm having the same issue but not on self signed certificate and on linux ( Fedora 29) 

Global Protect is configured with the certificate signed by the Authorized CA.

The Chain is:

DigiCert Global Root CA
DigiCert SHA2 Secure Server CA

Server certificate.

It works perfect on Windows.

On Linux, Fedora.

I get the error 

Error: Gateway exgw: The server certificate is invalid. Please contact your IT administrator.

I checked if certificate is trusted 

xxx\Downloads]$ trust list | grep Digi
label: DigiCert Global Root CA
label: DigiCert SHA2 Secure Server CA

The first two are the exactly the ones that are trusted.

I am puzzled. Did anybody have issues with Global Protect on linux ? 

[BPry]

@PiankaMariusz,

Are you actually sending the full chain, or are you only sending your Server certificate? 

[IPSonIE]

Well,

Full chain is present on the firewall.

However, I did a lot of googling since I posted it.

I found this

https://www.reddit.com/r/paloaltonetworks/comments/9hh9g0/does_globalprotect_work_with_linux_distrib...

And I believe this is an issue.

I can understand the software is supported on 3 distros of Linux, but technically Fedora is Redhat.

I am going to try Global Protect on Centos next and if it will work without me changing a single line of configuration on Palo Alto that will be it.

[Rajesh12 · Accepted solution]

Hello @PiankaMariusz

Yes, as per PA it supports below three types of Linux distributions only.

I do have 3rd party CA signed cert configured and tested it on both Ubuntu and RHEL. It works smoothly without any issues.

https://www.paloaltonetworks.com/documentation/global/compatibility-matrix/globalprotect/where-can-i...