HIPs check for Client Side Certificate

[CZellars]

Is it possible to use HIPs to verify the presence of a Client Side Certificate such as GlobalProtect cert for a computer and also check for cert on a mobile device? If the device has the cert then we would allow it through a firewall policy.

[OtakarKlier · Accepted solution]

Hello,

GP has a certificate it can use to verify the client. Check this article out and see if it meets your requirements.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect-Portal-wi...

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/get-starte...

Cheers!

[OtakarKlier]

Hello,

Would this device you are attempting to check behind the firewall or connecting via a client VPN connection?

Regards,

[CZellars]

Thanks for replying and it would be connecting via a GlobalProtect VPN client.

[OtakarKlier · Accepted solution]

Hello,

GP has a certificate it can use to verify the client. Check this article out and see if it meets your requirements.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect-Portal-wi...

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/get-starte...

Cheers!

[CZellars]

Thanks for that info. The issue is that we would need to check for a specfic certificate: the machine certificate and I cannot seem to find a registry entry that allows me to do that. I believe I need to open a case with Palo Alto Support and I will report back with results if possible. Thank You

[CZellars]

Well in the end we did not find a way to use HIPs custom checks in order to verify a machine certificate. The issue being that the certificate stuff is stored in the registry in blob format which doesnt allow parsing for specifics.

I have convinced the team to move forward by using GlobalProtect Certificate check against our PKI