GlobalProtect - Renew Certs and Upgrade Clients for remote user in production

Reply
L0 Member

GlobalProtect - Renew Certs and Upgrade Clients for remote user in production

Current CA and Device Certs need to be renewed. GP client software updated. 

Can someone tell me how folks are doing this if they need an active GP VPN connection to deploy to the clients in the first place? 

We do not use Portal. - and Users cannot install software on devices

 

Any suggestiosn?

 

If I should make new CA/Device certs (certs are both created on FW) assume I would need new naming conventions? 

Any tips how to get the new client upgraded - when they are connected using the current client? And do not have perms to do so on their own? 

 

Thanks - and hope everyone is staying safe/healthy


Accepted Solutions
Highlighted
L0 Member

I created new certs

Deployed over VPN while current/old certs still in use

 

then cutover portal/config to new CA new cert configs

 

all set

View solution in original post


All Replies
Highlighted
L2 Linker

Hi,

If they are generated on the firewall, then they can be renewed on the firewall, by selecting the certificate and clicking renew at the bottom. 

You can also create new certificates for Root, Intermediate, and server. You will need to change the server certificate in the SSL/TLS profile which is being used for the Portal and Gateway, then the Root and intermediate certificates can be added to the Portal config under Portal --> Agent --> Trusted Root CA, so they're trusted for the GP connection. 


If you wanted the user browser to trust the Root and Intermediate CA certificates alongside GP client, then you can also check the box next to the certificate "Install in Local Root Certificate Store"

 

Users should have permission to install the Root and Intermediate CAs to their local Trust Root Certificate Store.

 
Let us know if that helps

Thanks and stay safe!

Highlighted
L0 Member

I created new certs

Deployed over VPN while current/old certs still in use

 

then cutover portal/config to new CA new cert configs

 

all set

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!