Self-signed Root CA Certificate FQDN?

[welly_59]

I’m planning a test deployment of a globalprotect vpn, so currently going through the guides to see what’s needed. Part of the requirements if not using a trusted CA is to generate a self-signed root CA.

What should the FQDN be on this cert? The deployment will have inside, outside and mgmt interfaces. Should it be the ip on the mgmt interface?

[Remo]

Hi @welly_59

Do you also plan to implement an internal gateway?

In the root CA cert it does not really matter what you enter as CN. This cert you simply need to install on your computer. As portal and gateway cert you then you need to create another cert which is signed by the previously created root CA cert. In this cert I would use the FQDN or IP of the portal and gateway. Make sure that you also add the same as SAN (server alternative name) to the cert when you create it.

For the management interface cert I recommend to use a different cert than for portal/gateway.

Hope this helps,

Remo