Generate Certificate to be Signed by Public CA for Global Protect VPN

[EvanRaci]

Hi All,

We would like to use our GlobalProtect VPN using certificate signed by Public CA.

As the CA team is requesting to generate CSR from Palo Alto Firewall , can I follow below article to generate?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSxCAK

And we have two ISPs connected to PaloAlto Firewalls and we have two GlobalProtect VPN Gateways configured. If I want to use Public signed CA for both gateways , I need to generate separate CSR for each gateway right?

And when generating CSR , in the common name session , can I use public ip address instead of FQDN?

Please help me to confirm.

Thank you

[rmfalconer]

You can follow that link to generate a CSR.

You should generate a CSR on each node.

Public authorities will not include IP addresses as CN or SAN entries. You'll need to use FQDN.

[Adrian_Jensen]

In addition to what @rmfalconer said, be sure to add SAN entries ("Host Name" field under Certificate Attributes) for the certificate. CN (Common Name) is no longer used for hostname certificate validation, the SAN is. Also, you can have multiple SANs under a single certificate and you can have a single certificate that covers multiple Portals and Gateways.

I run a combined certificate with a default FQDN as the CN and all my explicit Portal and Gateway FQDNs as SANs on the same certificate. I.e. a CSR to be signed by an external auth with:

Certificate Name = VPN_Certs

Common Name = vpn.example.com

Signed By - External Authority

Certificate attributes:

  County = US

  State = Allstate

  Locality = Anytown

  Organization = Acme Corporation

  Host name = vpn.example.com

  Host name = vpn-portal-a.example.com

  Host name = vpn-gateway-a.example.com

  Host name = vpn-portal-b.example.com

  Host name = vpn-gateway-b.example.com