GlobalProtect issue on Android device

[FarzanaMustafa]

Error message: gateway external server cert is invalid

Only for Android users who are using GP version 5.1 or 5.2.

No issues with 5.0. Using PANOS 9.1.3

Using Public Certificate and we only received 1 PEM file from the client.

The server cert (SSL1_Networkscomms) is standalone. Not sure how to add it to the cert chain.

Added the Root CA and Intermediate CA :

Do I need to install the server cert on the Android device to make GP work?

[ihateds]

GlobalProtect for Android connects to a GlobalProtect gateway on a Palo Alto Networks next-generation firewall to allow mobile users to benefit from enterprise security protection. Enterprise administrator can configure the same app to connect in either Always-On VPN, Remote Access VPN or Per App VPN mode. The app automatically adapts to the end user's location and connects the user. echat chatspin

[FarzanaMustafa]

Hi @BPry 

I need your suggestion please for this one.

[BPry · Accepted solution]

@FarzanaMustafa,

What actually signed the SSL1_Networkscomms? Sounds like the cert if possibly just signed by the intermediate CA and not the actual root CA, so you just need to create a combination certificate and import that. The following KB will walk you through that process.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkoCAC