Gateway certificate issue on Android Globalprotect

[jsalmans]

I've currently got a support case open for this, but I'm trying to see if other users are having the same issue.

From what I've seen:

6.1.11 - No issue

6.1.12 - No issue

6.1.13 - Issue Occurs

6.1.14 - Issue Occurs (current version on Play Store)

The issue seems to be that the client doesn't trust the certificate for the gateway.  I'm not sure if it's the same bug or not, but it sounds similar to:

GPC-24228
Fixed an issue where Android devices running the GlobalProtect agent were unable to connect to gateways, displaying a "Could not verify the server certificate of the gateway" error. This occurred because a common code change caused the GlobalProtect agent to use the OpenSSL framework for gateway server certificate handshakes, which was unable to access certificates stored in the Android key-store.

GPC-24228 was marked as fixed in 6.1.11, though.  The actual error I see on an Android client:

"GlobalProtect failed to connect to the login server.  Contact your IT help desk to resolve the issue

Error Details:
The certificate for this server was signed by an unknown certifying authority.  You might be connecting to a server that is pretending to be [insert gateway cert CN here] which could put your confidential information at risk."

The fact that it is getting my gateway list implies it is authenticating past the portal, SSO, and MFA.  I can downgrade from 6.1.14 to 6.1.12 and connect with no errors with no config change on the firewall or client (other than the re-install).

Anyone else seeing this?

Thanks!

[Helmut_Wenzel]

Hello,

We're having the same problem with our self-signed certificate.
The following error appears in the client log:

javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
(21433)08/31 12:13:34:876212 - PanHttpsClient: exception GetHttpResponse, response code is 0
(21433)08/31 12:13:34:876645 - PanHttpsClient: response from server is:
null, exception Message: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
 eType:javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: []
(21433)08/31 12:13:34:876743 - (l6)JNI,21491,228,after JNIGetHttpResponse, ret=Valid(21433)08/31 12:13:34:876889 - (l5)JNI,21491,324,not handled, ret=error, javax.net.ssl.SSLPeerUnverifiedException: Hostname gp.domain.com not verified:
    certificate: sha1/TzYD8P8Glo0Ha4UUtj5iUe8xkBM=
    DN: CN=gp.domain.com
    subjectAltNames: [], return NULL now
(21433)08/31 12:13:34:876918 - (l6)JNI,21491,8121,prelogin to portal result is 
(null)
(21433)08/31 12:13:34:876961 - (l6)JNI,21491,8461,Failed to pre-login to the portal gp.domain.com with return value 0(0).

However, it works with the Global Protect app version 6.1.12.

Best regards

[jsalmans]

I experimented a bit this morning and determined that if I manually installed the signing certificate as a trusted CA on my Android device, I was able to connect with 6.1.14 again.  This leads me to believe one or more of the following may be true:

1. The root CA is not being installed on the mobile Android device, despite the settings on the firewall telling it to install on client device's trust stores (I thought I read somewhere that the certs are installed to a private GP trust store on Android but I'm not sure how accurate that information is).
2. Something has changed on the GP Android client, such as not having access to the private certificate store file (if it ever existed), not having access to the Android trusted CA list to install the cert, or that the client was never previously actually verifying the certificate chain but it is now
3. Something has changed on Android that the developers need to account for (less likely I think since 6.1.11 and 6.1.12 still work)

I've got a ticket open for this issue and have updated it with the info about testing the manual certificate install.

[jsalmans]

The case has been updated this morning and we are now waiting on engineering to confirm, however, it appears that certificate chain may not have been previously getting verified on Android devices and it may now be enforced which means the signing certificate for private gateway certs might now need to be installed on the Android clients (we've had to do this on Apple devices for a while).

The option to distribute the necessary certificates from the portal appears to be only for Windows and Mac clients.

[jsalmans]

Palo support have confirmed this is an intended change in behavior and that the chain for private certificates will now need to be deployed to the Android clients (manually or via MDM) just like Apple mobile clients.

[Helmut_Wenzel]

Thank you for your reply.

We’ve deployed our root certificate to our Android devices via MDM (Workspace One). The certificate is stored in the user store. To store it in the system store, the device would need to be rooted, which is generally not supported by the MDM.

The certificate also works perfectly for logging into our company Wi-Fi via RADIUS. However, GlobalProtect does not seem to accept the certificate. Does GlobalProtect perhaps only access the system store?

[jsalmans]

I'm not an expert here, but not to my knowledge.

I installed our root cert manually by downloading the cert and then going through the CA install option on the device.  It installed in the CA trust store under the User certificates (Personal section) and I'm able to connect to GlobalProtect just fine now.