Global Protect - Linux Fedora , CA trusted cert error

PiankaMariusz · ‎10-31-2018

Hi There,

I'm having the same issue but not on self signed certificate and on linux ( Fedora 29)

Global Protect is configured with the certificate signed by the Authorized CA.

The Chain is:

DigiCert Global Root CA
DigiCert SHA2 Secure Server CA

Server certificate.

It works perfect on Windows.

On Linux, Fedora.

I get the error

Error: Gateway exgw: The server certificate is invalid. Please contact your IT administrator.

I checked if certificate is trusted

xxx\Downloads]$ trust list | grep Digi
label: DigiCert Global Root CA
label: DigiCert SHA2 Secure Server CA

The first two are the exactly the ones that are trusted.

I am puzzled. Did anybody have issues with Global Protect on linux ?

Rajesh12 · ‎10-31-2018

Yes, as per PA it supports below three types of Linux distributions only.

I do have 3rd party CA signed cert configured and tested it on both Ubuntu and RHEL. It works smoothly without any issues.

BPry · ‎10-31-2018

Are you actually sending the full chain, or are you only sending your Server certificate?

IPSonIE · ‎10-31-2018

Well,

Full chain is present on the firewall.

However, I did a lot of googling since I posted it.

I found this

And I believe this is an issue.

I can understand the software is supported on 3 distros of Linux, but technically Fedora is Redhat.

I am going to try Global Protect on Centos next and if it will work without me changing a single line of configuration on Palo Alto that will be it.

Rajesh12 · ‎10-31-2018

Yes, as per PA it supports below three types of Linux distributions only.

I do have 3rd party CA signed cert configured and tested it on both Ubuntu and RHEL. It works smoothly without any issues.