GlobalProtect getting "Connection failed" message (sectigo certificate)

[Marc.Luecke]

Hi,

suddenly we are getting a "connection failed" message from the GlobalProtect Client while using the sectigo wildcard certificate in the TLS Profile of the NGFW.

The traffic logs show a 'decrypt-error'.

There is no decryption policy being used.

We are on PanOS 9.0.7.

It's a bit strange because everything worked just fine until now and there weren't any changes made. 

Could that refer to the known sectigo certificate problem?

Is there maybe a fix for this?

Best regards,

Marc

[BPry]

@Marc.Luecke,

The firewall decrypts parts of GlobalProtect traffic regardless of what you have configured in your decryption rule base, and if you are using a Sectigo certificate which is cross-signed with AddTrust and UserTrust then your certificate would have been invalidated as far as the firewall is concerned on the 30th. 

[Marc.Luecke]

Hi,

I see. Thank you very much for your fast answer.

Is there any way around this?

I assume there are several users with the same problem at this time.

Best regards,

Marc Lücke

[BPry · Accepted solution]

@Marc.Luecke,

Generate a new certificate for use with GlobalProtect would really be my answer to this question. You should be able to get your wildcard certificate re-issued without the cross-signing between AddTrust and USERTrust and just have USERTrust in the chain, which would a fully valid certificate. 

[Marc.Luecke]

I will try that.

Thank you very much!!

Best regards,

Marc Lücke

[Arecio]

Hello,

Did you manage to solve the problem, I have a similar error.

This occurs after migrating from Windows 10 to Windows 11.

Thanks for any help you can provide me.

Greetings.