Global Protect Certificate Authentication

[L1_ENG]

Hi Team,

We are using self signed certificate for user authentication signed by self-signed CA cert on Palo Alto for our global protect.

does my understanding below is correct regarding certificate expiration/renewal.

1. if CA cert expired while user cert still valid, user does not need to install renewed CA cert.

we can renew the CA cert on palo alto and user will be able to connect to global protect again.

2. If we renew user certificate (i.e user cert is still valid and we renew for 1 year), user will need to install new renewed certificate.

Thanks

[trivers01 · Accepted solution]

Hey @L1_ENG  I hope all is well!

1. If the CA certificate used to sign any intermediate or leaf certificate expires, then each subordinate child ticket will be invalidated also. This is true regardless of the certificate being self-signed form the firewall itself or imported from an internal PKI.

2. If the CA certificate is generated on the firewall, and is renewed on the firewall prior to expiring, then it doesn't require being redeployed to the endpoints, as it will automatically be updated.

I hope this helps with your questions! 

-Stay safe and have a great day!

[L1_ENG · Accepted solution]

Hi @trivers01!

Thank you for your response,