Problem with certificate after upgrading GlobalProtect 1.1.7

[jmrodriguez]

Hi everyboy.

Up to now, I've had working a Globalprotect configuration, with only a Server Certificate, and it worked very well.

After upgrading to version 1.1.7, I've received the message: "The paloalto.xxxxx.es certificate is not signed by a trusted certificate authority.". That is a problem for "no on demand" VPN connections, because you have to click "Continue" to make VPN connection work.

Do you know how I could solve this?

One solution is to create another certficate based on a Trusted CA certificate and send it to all the clients to install it, but it is difficult to do in our situation right now.

Could you help me please?

Thank you very much.

[emr_1 · Accepted solution]

I believe there are two ways.

One:

If you use self signed server cert, you need to trust this on the each browser, I mean I device.

Two:

If you don't want to do that, you need to purchase public server certificate such as verisign.

Each browswer already trust verisign and major CA, you don't need to register it as trusted CA.

You can find official announcement about this enhance at top of support portal.

=====

GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate.

The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match.

Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN.  If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error.

If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues.

=====

OR

You can use v1.1.6 and make feature request to PaloAltoNetworks to disable certificate check.

v1.1.6 does not check trusted CA.

Regards

[lauro7]

I have same problem with GP 1.1.7, and because my portal isn't registered on DNS as FQDN, I have done exactly what you suggested, that I have used IP address in CN, SAN, and IP of portal and gateway, but certificate error is still present.

I have also imported that certificate on my browser, but nothing...I think to downgrade GP to 1.1.6.

Regards.

[emr_1]

Are you sure?

I could erase cert error with IP.

I'll show you what I did in Excel file.

Please refer to it.

Don't surprise to Japanese... I commented in English .

Regards,