wild card certificate.

[Jafar_Hussain]

Dears,

i am using a wild card certificate for global protect. when i tried to connect global protect agent. i am facing the below issue:-

Certificate description:-

I have imported the wild card certificate that is sign by digicert.

firstly i have imported trusted root CA.

Then intermediate CA.

After that the server chain certificate.

Configuration description:-

I have used root CA and intermediate CA in a local trusted root certificate store.

And the server certificate we are using in SSL/TLS profile.

PAN-OS version - 8.1.11

GP version - 5.1.0

I have just a question:-

is there any limitation for a subdomain in the wild card certificate?

example:- i am using the domain "abc.vpn.contoso.com.uk"

Appreciate your response.

[rmfalconer]

What's the CN on the cert? If it's *.contoso.co.uk, it won't work. You would need *.vpn.contoso.co.uk.

This isn't a limitation of GP, it's the behavior with any certificate. 

[Mick_Ball]

Hmmmm...   seems a bit odd that you are offered a gateway in the first place. I assume you had no certificate error for the portal...   do you get an error if  you browse https to your portal?

[Jafar_Hussain]

@rmfalconer 

The CN on the cert is *.contoso.com.uk. and the gateway URL is *.abc.vpn.contoso.com.uk.  as per your suggestion would i need to change the common of the certificate like *.vpn.contoso.co.uk?

[rmfalconer]

Let's say the url is 1.abc.vpn.contoso.co.uk, then you would need a wildcard for *.abc.vpn.contoso.co.uk.

*.vpn.contoso.co.uk would not work for 1.abc.vpn.contoso.co.uk

The * only functions at one level.

[Jafar_Hussain]

@rmfalconer 

Thanks for the detail. i will change the CN name.

Then i will try.