You have 3 options when implementing certificate-based client authentication for your GlobalProtect environment.
-
Shared client certificates - each endpoint uses the same certificate to authenticate; it can be locally generated or imported from trusted CA. Please note that this certificate would be installed in the user certificate store only. Machine certificates (that need to be imported in machine certificates store) cannot be pushed from portal.
-
Unique client certificates - requires either the implementation of a SCEP server on your network or use of an internal PKI to deploy them individually to each machine through GPO or using other device management systems
-
Machine certificates - used with the Pre-Logon connect method to authenticate the device rather than the user
-
Certificate selection based on OID - a specific object identifier (OID) can be used to identify the certificate to be used.
The certificate imported to the client machine(s) may or may not be signed the same root CA which signed the 'Server Certificate' in the Portal/Gateway settings. However, please ensure the appliance has the full CA certificate chain of trust imported on the user's machine: i.e Root + Intermediate (if applicable) CAs.
Note: The client certificate will be indented under the root CA when viewing from the
Device > Certificates
in the GUI.
In cases of self-signed certificates, the certificate will need to be imported to the trusted root CA.
For instructions for how to:
Additional Information
For additional documentation regarding certificates and their use within the GlobalProtect environment, please refer to the following documents:
How Does the App Know Which Certificate to Supply?
Set Up Client Certificate Authentication
