Global Protect Android client failing with certificate error after upgrading PAN-OS

[idelconsulting]

Dear all,

I have a strange error after I upgraded my firewall to  PAN-OS 11.1.15 to fix a GP vulnerability.

(18990)06/04 17:44:57:208734 - PanKeyManager: Issuers: CN=ixxx, DC=ixxx, DC=local
(18990)06/04 17:44:57:208841 - PanKeyManager: Use Cert: gp_user_new
(18990)06/04 17:44:57:208883 - PanKeyManager: getPrivateKey for alias: gp_user_new
(18990)06/04 17:44:57:250906 - PanKeyManager: getCertificateChain for alias: gp_user_new
(18990)06/04 17:44:57:395190 - PanHttpsClient: 1738, found exception:javax.net.ssl.SSLHandshakeException: Read error: ssl=0x7a7d04ed18: Failure in SSL library, usually a protocol error
error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE (external/boringssl/src/ssl/tls_record.cc:486 0x7b3d077350:0x00000003)
(18990)06/04 17:44:57:395437 - PanHttpsClient: client cert is selected but invalid.
(18990)06/04 17:44:57:395543 - removeClientCertAlias...

Not much help from support so far.

User cert is generated from a Microsoft CA.

Does anyone have the exact details how the client certificate should look like if it is coming from Microsoft?

Or the detailed settings for the certificate template to use?

Regards,

   Andreas