Deploy Shared Client Certificates for Authentication

Generate a certificate to deploy to multiple GlobalProtect endpoints.
Create the root CA certificate for issuing self-signed certificates for the GlobalProtect components.
Select
Device
Certificate Management
Certificates
Device Certificates
, and then
Generate
a new certificate.
Set the
Certificate Type
to
Local
(default).
Enter a
Certificate Name
. This name cannot contain spaces.
Enter a
Common Name
to identify this certificate as an app certificate (for example,
GP_Windows_App
). Because this certificate will be deployed to all apps using the same agent configuration, it does not need to uniquely identify a specific user or endpoint.
In the
Signed By
field, select your root CA.
Select an
OCSP Responder
to verify the revocation status of certificates.
Click
OK
to generate the certificate.
Set Up Two-Factor Authentication.
Configure authentication settings in a GlobalProtect portal agent configuration to enable the portal to transparently deploy the client certificate, which is
Local
to the firewall, to apps that receive the configuration.