Global Protect Certificate SSL Self Signed Expired GP SSL/TLS Profile

To see this working, head to your live site.

Global Protect Certificate Self Signed Expired

Hi, How are they doing?

I have a concern with the following scenario.

If I have a PA configured with a Self Signed SSL certificate for Global Protect use, SSL/TLS profile for GP, and that certificate is about to expire.

All the workstations that have the global protect client, have the certificate installed, so that it is recognized as a trusted entity, in the computers (since it is self-signed by the same PA).

Now if I renew that certificate in the Palo Alto Networks Firewall, will I have to download and reinstall that certificate on each workstation? In theory I think that if the certificate will change, that is to say it will be renewed and extended its duration, therefore when the expiration date of the certificate that the users already have installed to validate the SSL/CA selfsigned certificate of the PA arrives, it will not allow them to connect.

Please your comments, suggestions, tips regarding the above.

Thanks

Regards

4 comments

Comments (4)

Reaper

Jan 13, 2023

Yes that will work :)

Reaper

Jan 12, 2023

do you have a root CA that signed the TLS certificate?

yiou can easily push the root cert to clients when they connect, at which time if you refreshed the root and the TLS, they will trust the new cert

the only caveat is that you need to do this before the root CA expires else they won't be able to connect anymore (unless you set the agent to be allowed to connect to the portal even if the certificate is fishy)

Reaper

Jan 12, 2023

Replying to

MetgatzGR

Jan 13, 2023

Replying to

Hello @Reaper, thank you for your quick response.

Yes, correct, it is a CA self-signed by the PA, which uses the certificate for the GlobalProtect SSL/TLS profile.

Ok, so the recommendation is to use the "Install in Local Root Certificate Store" option. There is no problem with a CA certificate, self-signed by the same PA, I installed it automatically with this option in the Windows workstations?

In this case, then I would configure another CA, which applied the option "Install in Local Root Certificate Store" gave it a few days, so that it installs it to the clients as they connect to the GP VPN, and then make the switch at the SSL/TLS level. Would this be a good option?

Thank you, stay tuned, best regards.

Forum: Forum