Installing a new cert

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Installing a new cert

L3 Networker

For Global Protect I currently have a server cert on my PAN 3220. When i imported it it had the entire chain - root, intermediate and the server cert. That server cert is now nearing expiration. I gave our cert manager a CSR from the PAN and I now have the new .PEM formatted server cert with longer expiry and the chain which includes the root and intermediate certs. 

 

1) Can I install this into the device certificates store under a different certificate name? And this would not affect the existing certificate profile. 

 

2) To upgrade to the new cert my plan would be to change the certificate profiles to point to the new server cert and then test that Global Protect is authenticating OK. If the cert based auth GP was failing then I would change back the cert profile to point to the old certificate. Does this sounds like a reasonable approach?

1 accepted solution

Accepted Solutions

L1 Bithead

If you try to upload a cert that is a renewal of an identical cert - the fw will likely just replace the existing one with the new one. The name you give it on the fw will not matter. The fw will see the body of the certificate is identical to one already installed that just has an extended expiration date, and update the existing cert with the new name you gave it.

 

I'm certainly no certificate expert. But I've had the best luck using the shotgun method. Delete the existing cert chain then upload the updated cert chain.

View solution in original post

1 REPLY 1

L1 Bithead

If you try to upload a cert that is a renewal of an identical cert - the fw will likely just replace the existing one with the new one. The name you give it on the fw will not matter. The fw will see the body of the certificate is identical to one already installed that just has an extended expiration date, and update the existing cert with the new name you gave it.

 

I'm certainly no certificate expert. But I've had the best luck using the shotgun method. Delete the existing cert chain then upload the updated cert chain.

  • 1 accepted solution
  • 1571 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!