Gateway certificate issue on Android Globalprotect

[jsalmans]

I've currently got a support case open for this, but I'm trying to see if other users are having the same issue.

From what I've seen:

6.1.11 - No issue

6.1.12 - No issue

6.1.13 - Issue Occurs

6.1.14 - Issue Occurs (current version on Play Store)

The issue seems to be that the client doesn't trust the certificate for the gateway.  I'm not sure if it's the same bug or not, but it sounds similar to:

GPC-24228
Fixed an issue where Android devices running the GlobalProtect agent were unable to connect to gateways, displaying a "Could not verify the server certificate of the gateway" error. This occurred because a common code change caused the GlobalProtect agent to use the OpenSSL framework for gateway server certificate handshakes, which was unable to access certificates stored in the Android key-store.

GPC-24228 was marked as fixed in 6.1.11, though.  The actual error I see on an Android client:

"GlobalProtect failed to connect to the login server.  Contact your IT help desk to resolve the issue

Error Details:
The certificate for this server was signed by an unknown certifying authority.  You might be connecting to a server that is pretending to be [insert gateway cert CN here] which could put your confidential information at risk."

The fact that it is getting my gateway list implies it is authenticating past the portal, SSO, and MFA.  I can downgrade from 6.1.14 to 6.1.12 and connect with no errors with no config change on the firewall or client (other than the re-install).

Anyone else seeing this?

Thanks!

[Helmut_Wenzel]

Hello,

We're having the same problem with our self-signed certificate.
The following error appears in the client log:

javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
(21433)08/31 12:13:34:876212 - PanHttpsClient: exception GetHttpResponse, response code is 0
(21433)08/31 12:13:34:876645 - PanHttpsClient: response from server is:
null, exception Message: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
 eType:javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
(21433)08/31 12:13:34:876743 - (l6)JNI,21491,228,after JNIGetHttpResponse, ret=Valid(21433)08/31 12:13:34:876889 - (l5)JNI,21491,324,not handled, ret=error, javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: [], return NULL now
(21433)08/31 12:13:34:876918 - (l6)JNI,21491,8121,prelogin to portal result is 
(null)
(21433)08/31 12:13:34:876961 - (l6)JNI,21491,8461,Failed to pre-login to the portal gp.domain.com with return value 0(0).

However, it works with the Global Protect app version 6.1.12.

Best regards

[jsalmans]

I experimented a bit this morning and determined that if I manually installed the signing certificate as a trusted CA on my Android device, I was able to connect with 6.1.14 again.  This leads me to believe one or more of the following may be true:

1. The root CA is not being installed on the mobile Android device, despite the settings on the firewall telling it to install on client device's trust stores (I thought I read somewhere that the certs are installed to a private GP trust store on Android but I'm not sure how accurate that information is).
2. Something has changed on the GP Android client, such as not having access to the private certificate store file (if it ever existed), not having access to the Android trusted CA list to install the cert, or that the client was never previously actually verifying the certificate chain but it is now
3. Something has changed on Android that the developers need to account for (less likely I think since 6.1.11 and 6.1.12 still work)

I've got a ticket open for this issue and have updated it with the info about testing the manual certificate install.