Intune with IOS and Global Protect, utilizing certificate-based authentication troubles.

[Ben_Laney]

We have been trying to migrate a client from Airwatch to Intune for MDM management. Part of this deployment was implementing certificate-based authentication for their Global Protect VPN client.  We have been successful with Windows, and Android. However, we have not been able to get MacOS, iPadOs, or IOS to work successfully. all the Error logs indicate that the Global Protect application does not know how to identify the certificate that is being deployed via Intune. We have validated that Root and Intermediate certificates are on the devices. I am all ears as to any help anyone can provide on this. 

[TorstenForster]

Hi Ben,
I also work on the same setup with intune and ios.

It seems that we run into the same issue. 

Did you find a solution for that?

In the PANGPS log I found the errors:

"Couldn't find any matching identities. Trying to continue without client cert

Client cert error detail is Client cert usage check failed

error detail is Client cert usage check failed"

Any Idea? Is it a problem with the certificate store lookup?

kind regards 

Torsten

[Ben_Laney]

We ended up scaping the project , and going back to Airwatch. if you ever figure it out, i would be interested to know how to get around those errors.

[TorstenForster]

Yes, we found a solution right know. 

The Problem was that the intune vpn profile wasn't pushed to the device. My Collegues analyzed it and changed something. Now, everything is working fine with a split vpn setup. Certificate autheneticaten and user authentication is working fine.

Also the tag detection on the device.

The only problem we found is that intune doesn't remove the app again. Only installation is working fine

[Ben_Laney]

If you could find out what your colleagues did to get it to work, you would be a life saver.