Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-22-2022 12:06 PM
For Global Protect I currently have a server cert on my PAN 3220. When i imported it it had the entire chain - root, intermediate and the server cert. That server cert is now nearing expiration. I gave our cert manager a CSR from the PAN and I now have the new .PEM formatted server cert with longer expiry and the chain which includes the root and intermediate certs.
1) Can I install this into the device certificates store under a different certificate name? And this would not affect the existing certificate profile.
2) To upgrade to the new cert my plan would be to change the certificate profiles to point to the new server cert and then test that Global Protect is authenticating OK. If the cert based auth GP was failing then I would change back the cert profile to point to the old certificate. Does this sounds like a reasonable approach?
03-22-2022 01:22 PM
If you try to upload a cert that is a renewal of an identical cert - the fw will likely just replace the existing one with the new one. The name you give it on the fw will not matter. The fw will see the body of the certificate is identical to one already installed that just has an extended expiration date, and update the existing cert with the new name you gave it.
I'm certainly no certificate expert. But I've had the best luck using the shotgun method. Delete the existing cert chain then upload the updated cert chain.
03-22-2022 01:22 PM
If you try to upload a cert that is a renewal of an identical cert - the fw will likely just replace the existing one with the new one. The name you give it on the fw will not matter. The fw will see the body of the certificate is identical to one already installed that just has an extended expiration date, and update the existing cert with the new name you gave it.
I'm certainly no certificate expert. But I've had the best luck using the shotgun method. Delete the existing cert chain then upload the updated cert chain.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
