GlobalProtect certificates

[marjan]

In my company we have AD and our internal CA. I want to use our internal CA for GlobalProtect. What I have done so far:

     I've import our root CA to PA500 (PANOS 5.0.3).

     I've generated web server certificate and imported it in PA500

     I've created GP gateway and portal.

When I try to submit changes it says "invalid certificate chain".

We have root CA and subordinate CA. I've tried importing both certificates with same result. The certificate that is generated for PA500 is exported with private key (and imported).

Is this scenario supported, using our internal CA?

Thanks

[JohanL]

This is a working scenario. Could it be that your certs are not in the correct format ?

I wrote a document which is on my site www.accessdenied.be on how to create a cert and to import it.

[marjan · Accepted solution]

Thank you for your reply.

Something was wrong with certificates that I've imported. I've exported and imported again root ca and subordinate ca. Now it's working.