Revoked Machine Certificate still able to Connect Global Protect Gateway

[Sec101]

It appears possible to configure the firewall to be an OCSP responder to itself/clients from the posts below? Is that correct? (Specifically referring to self-signed certificates generated on the firewall)   If so, is there any risk to having this service run on an external interface, in order to control/revoke machine certificates?  If the need arises for a certificate revocation, is the firewall responding to itself and not letting the client connect to the portal/gateway, or is the client ultimately making that decision?

I'm finding the GP agent will still connect to the Gateway even if I have revoked a generic machine certificate used in the profile for the Gateway.  The CA certificate is still good, but If I revoke the machine certificate, and it shows revoked in the firewall, the client can still connect.   

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClteCAC

[tomdevos-D09]

Same question here. How to get GP to check for revoked certs if there is no CRL or OCSP because it's self signed by the PA

[tomdevos-D09]

@Sec101 

As I had the same question I did some investigation 🙂

You need to:

- Enable OCSP checking in Device > Session => Decryption Settings

- Create an HTTP OCSP Service Management Profile under Network Profiles > Interface Management

- Create An OCSP Responder under Device > Certificate Management > OCSP Responder

- Create Client Certificates with this Responder as OCSP Responder

- make sure OCSP checking is enabled on the Certificate profile used for GP

Next to that: 

Pay attention that if you revoke the certificate in the Certificate store it isn't automatically and immediatly revoked for the GP service as OCSP is cached on the FW: 

To immediatly have affect you need to execute the following commands in CLI 

• debug sslmgr delete ocsp all (or instead of all tab comlete with your OCSP URL

• debug dataplane reset ssl-decrypt certificate-status

Now the certificate will be revoked and if the client tries to (re)connect it will get that message.