GlobalProtect Certificate Prompt

[mmclimans]

My users using GlobalProtect on Windows are experiencing a very strange problem when they connect with GlobalProtect.   I am stuck on this one, any tips, pointers, or possible solutions are much appreciated.  

Usage:

• Our GlobalProtect clients connect using pre-logon with certificates.  We are not using SSO.    

Problem:

• Every once and a while, GlobalPrtect will throw a "certificate error" (see attached image of the error).  

Notes:

• When I check the Microsoft Certificate store, the certificate is installed correctly. 
• A reboot of the user's computer fixes the issue (certificate prompt does not come back)
• Error happens among all the clients, completely at random (typically when they start-up their computer).

PAN-OS 7.0.3

GlobalProtect 2.2.1

[mmclimans · Accepted solution]

I thought I would circle back and answer this:

In Windows, if you are using self-signed certificates, I found that both the CA and machine/client certificate must be put in both the Computer and User certificate stores.  I am not sure if this works for all variations of Windows, but it works in Win7, 8, and 10 from my testing.

1. On Windows machine, open MMC console.
2. File->Add/Remove Snap-ins...
3. Click "Certificates" and add the Computer Account certificate store.
4. Close out of Add/Remove Snap-ins... 
5. Expand Computer Account store in MMC window.
   1. Right click Personal->Import 
      1. Import both the CA and the machine/client certificate individually.
   2. Right click Trusted Root Certificates->Import
      1. Import both the CA and the machine/client certificate individually.
6. Do steps 1-5 again, except select "My User Account" certificate store in Step 3.