Support for Native Certificate Store for Prisma Access and GlobalProtect App on Linux Endpoints

1. Place the certificate in the native store location.

   For example:

   sudo cp xxxxx.cert.pem /etc/ssl/certs

   sudo cp xxxxx.key.pem /etc/ssl/private

   The following are the cert store locations for various Linux platforms:

   • Ubuntu:
     • Cert: /etc/ssl/certs
     • Key: /etc/ssl/private
   • Fedora:
     • Cert: /etc/ssl/certs
     • Key: /etc/ssl/private
   • Red Hat
     • Cert: /etc/pki/tls/certs
     • Key: /etc/pki/tls/private

   The supported formats are:

   • .pem
   • .p12

   • When the certificate is .pem format, the certificate will reside in /etc/ssl/certs location and the key will reside in /etc/ssl/private location. The key file in /etc/ssl/private can be either .pem or .key format
   • When the certificate is .p12 format, the format already contains the key and there will only be a certificate containing the key in /etc/ssl/certs location.

   Root access is required to place the certificate using sudo cp command in the locations as mentioned in Step 1 for various Linux platforms, for example, for Ubuntu:
2. (Optional) Store the key in the /etc/ssl/private folder if the certificate is .pem format.
3. Connect GlobalProtect, select your client certificate, and proceed with the next steps. End users must enter the passcode to authenticate to the app for the first time. The app will not prompt end users to enter the passcode for the subsequent authentication attempts unless the app is uninstalled or the user is signed out of GlobalProtect from the portal.

   If the certificate format used is .pem and when there is more than one certificate matching the criteria, the GlobalProtect app filters the certificates and displays the list of certificates in the Certificate Selection pop-up window. For the Certificate Selection pop-up window to display the certificate in the list, it should;

   • Match the CA list
   • Match the Client Authentication OID
   • Not be in Pending or Expired status.

   If the format used is .p12, the app does not filter the certificates and the Certificate Selection pop-up window displays all the certificates.

   Upgrade Scenario:

   • When you are using Client Certificate Authentication and upgrade to the GlobalProtect app version 6.2.0, you must reboot your system after a successful version upgrade.