The certificate is located in the certificate store, as configured
in the GlobalProtect portal agent configuration. By default, the
GlobalProtect app first looks for a valid certificate in the user
store. If none exist, the app then looks in the machine store. If
the GlobalProtect app locates a certificate in the user store, it
will not look in the machine store because the user store takes
precedence. To force the GlobalProtect app to look for certificates
in only one certificate store, configure the
Client Certificate
Store Lookup
option in the appropriate GlobalProtect
portal agent configuration.