Who rated this post

Hello TylerHay,

There are really no tricks...

Here's a working config I just did in my lab. It might give you an idea of what went wrong with your setup.

On the PA Firewall:

• Create a CA root:
  

  No need to enter any other information as this is to create a self signed cert later

• Now, create the self signed certificate. Make sure you signed it with the CA we just created. Enter at least the valid IP in the attributes to make this certificate valid:
  
  
• You will end up with something similar:
  

   

• Now, select the self-signed certificate (PA-UID-Cert in this case) and export it with the private key:
  

   

• Now, create a certificate profile with no other information than the CA root that has been created:
  
  
  
  
• Assign this Certificate profile too the "Connection Security" tab:
  

   

• You can now add the user ID agent configuration:
  
• Commit the changes.

On the UserID server:

• Add the certificate :
  

   

• Save and commit the changes...
• Go to "User Identification". After a few seconds, it should change the status to connected:
  

   

• On the PA side, it says the same:
  

   

Hope that helps!

R.