How to Renew Certificates for GlobalProtect Devices

[Carracido]

Hi all,

I want to renew the expiration date of the certificates for my globalprotect devices. The firewall is the CA that issued the certificates.

My question is whether I have to export and import the certificates after renewing them by following the steps on this article: 

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/certificate-management/revoke-and-re...

I don´t know if the certificates renewal requires any installation or the changes will be reflected in the devices without installation. 

Many thanks in advance,

Marcos

[syadav]

Hi Marcos,

Thanks for your response.

Also make sure that if the Client certificate is generated on firewall you export it in format PKCS12.

If this advice helps your case, please mark it as a solution so that it may help others.

[trivers01]

Hey @Carracido 

I know it's been a while since you've made this post, so I hope this message finds you well.

Since the certificates were generated on the firewall, we have the ability to renew them directly from the PAN-OS without having to re-deploy them.

I've included the document explaining this in further detail below for your reference. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POioCAG

Stay safe and have a great day!

-Cheers

[Deepak_K]

If we renewed self-signed cert , will be able to connect GP with expired self-signed cert already installed in user machine ?

We are able to get certificate warning while connecting GP on new machine.

But on already installed machine its giving server certificate not found error.  Also we have enabled installed certificate in trusted root store in Global Protect Portal > Agent but no luck.

Do we require to remove gateway address from GP client and need to reconnect ? in order to get certificate warning or to get renewed cert automatically installed on user machine.

If we install renewed certificate on user machine then we are able to connect GP.