deploying ssl decryption cert using global protect client

[Marcin_Jakubiec]

Hi,

I am trying to implement URL filtering for all users on Global Protect VPN.

I have done some tests and figure it out that I need to have ssl decryption policy set, matching the URLs to be blocked. I am using self-signed cert for ssl forward proxy, have manually exported the cert and imported into my local trusted root, everything seems to be fine.

The only question is how will I deploy the cert to all users? I dont want to do it manually for everyone, we dont have on prem DC. Is there a way to push the cert to the client using global protect client?

I am using public sectigo cert to secure vpn connection.

Regards,

[TomYoung · Accepted solution]

Hi @Marcin_Jakubiec ,

Yes there is!  If you navigate to Network > GlobalProtect > Portal > [edit portal] > Agent, you will see a TRUSTED ROOT CA section on the bottom.  Add your CA there.  If you check the INSTALL IN LOCAL ROOT CERTIFICATE STORE check box, the CA will be pushed to the client.  If you click on the ? in the upper right, then GlobalProtect Portals Agent Tab hyperlink, you will read "To install (transparently) the trusted root CA certificates that are required for SSL Forward Proxy decryption in the certificate store on the client, select Install in Local Root Certificate Store."

Thanks,

Tom