GlobalProtect
Client Certificate Authentication
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
9.1 (EoL)
- 10.1 & Later
- 9.1 (EoL)
-
-
-
- Deploy App Settings in the Windows Registry
- Deploy App Settings from Msiexec
- Deploy Scripts Using the Windows Registry
- Deploy Scripts Using Msiexec
- SSO Wrapping for Third-Party Credential Providers on Windows Endpoints
- Enable SSO Wrapping for Third-Party Credentials with the Windows Registry
- Enable SSO Wrapping for Third-Party Credentials with the Windows Installer
-
- Mobile Device Management Overview
- Set Up the MDM Integration With GlobalProtect
- Qualified MDM Vendors
-
- Remote Access VPN (Authentication Profile)
- Remote Access VPN (Certificate Profile)
- Remote Access VPN with Two-Factor Authentication
- Always On VPN Configuration
- Remote Access VPN with Pre-Logon
- GlobalProtect Multiple Gateway Configuration
- GlobalProtect for Internal HIP Checking and User-Based Access
- Mixed Internal and External Gateway Configuration
- Captive Portal and Enforce GlobalProtect for Network Access
-
-
- End User Experience
- Management and Logging in Panorama
-
- View a Graphical Display of GlobalProtect User Activity in PAN-OS
- View All GlobalProtect Logs on a Dedicated Page in PAN-OS
- Event Descriptions for the GlobalProtect Logs in PAN-OS
- Filter GlobalProtect Logs for Gateway Latency in PAN-OS
- Restrict Access to GlobalProtect Logs in PAN-OS
- Forward GlobalProtect Logs to an External Service in PAN-OS
- Configure Custom Reports for GlobalProtect in PAN-OS
- Monitoring and High Availability
-
- About GlobalProtect Cipher Selection
- Cipher Exchange Between the GlobalProtect App and Gateway
-
- Reference: GlobalProtect App Cryptographic Functions
-
- Reference: TLS Ciphers Supported by GlobalProtect Apps on macOS Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Windows 10 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Windows 7 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Android 6.0.1 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on iOS 10.2.1 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Chromebooks
- Ciphers Used to Set Up IPsec Tunnels
- SSL APIs
-
6.3
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- Download and Install the GlobalProtect App for Windows
- Use Connect Before Logon
- Use Single Sign-On for Smart Card Authentication
- Use the GlobalProtect App for Windows
- Report an Issue From the GlobalProtect App for Windows
- Disconnect the GlobalProtect App for Windows
- Uninstall the GlobalProtect App for Windows
- Fix a Microsoft Installer Conflict
-
- Download and Install the GlobalProtect App for macOS
- Use the GlobalProtect App for macOS
- Report an Issue From the GlobalProtect App for macOS
- Disconnect the GlobalProtect App for macOS
- Uninstall the GlobalProtect App for macOS
- Remove the GlobalProtect Enforcer Kernel Extension
- Enable the GlobalProtect App for macOS to Use Client Certificates for Authentication
-
- 6.1
- 6.0
- 5.1
-
6.3
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
End-of-Life (EoL)
Client Certificate Authentication
For enhanced security, you can configure the portal
or gateway to use a client certificate to obtain the username and
authenticate the user before granting access to the system.
- To authenticate the user, one of the certificate fields, such as the Subject Name field, must identify the username.
- To authenticate the endpoint, the Subject field of the certificate must identify the device type instead of the username. (With the pre-logon connect methods, the portal or gateway authenticates the endpoint before the user logs in.)
If you configure the portal or gateway to authenticate
users through client certificate authentication, users will not
have the option to Sign Out of the GlobalProtect
app if they authenticate successfully using only a client certificate.
For an agent configuration profile that specifies client certificates,
each user receives a client certificate. The mechanism for providing
the certificates determines whether a certificate is unique to each
user or the same for all users under that agent configuration:
- To deploy client certificates that are unique to each user and endpoint, use SCEP. When a user first logs in, the portal requests a certificate from the enterprise’s PKI. The portal obtains a unique certificate and deploys it to the endpoint.
- To deploy the same client certificate to all users that receive an agent configuration, deploy a certificate that is Local to the firewall.
Use an optional certificate profile to verify the client certificate
that the endpoint presents with a connection request. The certificate
profile specifies the contents of the username and user domain fields;
lists CA certificates; criteria for blocking a session; and offers
ways to determine the revocation status of CA certificates. Because
the certificate is part of the authentication of the endpoint or
user for a new session, you must pre-deploy certificates used in
certificate profiles to the endpoints before the users’ initial
portal login.
The certificate profile specifies which certificate field contains
the username. If the certificate profile specifies Subject in the
Username Field, the certificate presented by the endpoint must contain
a common-name for the endpoint to connect. If the certificate profile
specifies a Subject-Alt with an Email or Principal Name as the Username
Field, the certificate from the endpoint must contain the corresponding
fields, which will be used as the username when the GlobalProtect
app authenticates to the portal or gateway.
GlobalProtect also supports authentication by common access cards
(CACs) and smart cards, which rely on a certificate profile. With
these cards, the certificate profile must contain the root CA certificate
that issued the certificate to the smart card or CAC.
If you specify client certificate authentication, you should
not configure a client certificate in the portal configuration because
the endpoint provides it when the user connects. For an example
of how to configure client certificate authentication, see Remote
Access VPN (Certificate Profile).