The certificate is located in the certificate store, as configured in the GlobalProtect portal
agent configuration. By default, the GlobalProtect app first looks for a valid
certificate in the user store. If none exist, the app then looks in the machine
store. If the GlobalProtect app locates a certificate in the user store, it
won't look in the machine store because the user store takes precedence. To
force the GlobalProtect app to look for certificates in only one certificate
store, configure the
Client Certificate Store Lookup
option in the appropriate GlobalProtect portal agent configuration.