If your endpoints have multiple client certificates,
you can use the OID to instruct GlobalProtect which certificate
If you deploy multiple certificates to your
end user devices for distinct use cases--for example machine certificates,
user certificates, and email encryption certificates all issued
by the same certificate authority--it can be difficult to distinguish
which certificate to use in which use case. To help with this, you
can designate a specific object identifier (OID) that you want GlobalProtect
to use to identify which certificate to use. This simplifies and
improves the certificate selection process when your macOS or Windows
endpoints have multiple certificates installed.
An OID is
a numeric value that identifies the application or service for which
a certificate is used. When the certificate authority (CA) creates
the certificate, the CA automatically includes the OID in the Enhanced
Key Usage field.
create the certificate, you can specify the OID to identify the
certificate’s purpose. By default, GlobalProtect automatically filters
the certificates for those that specify a Client Authentication
purpose (OID 188.8.131.52.184.108.40.206.2) so it is not necessary to specify
the OID associated with Client Authentication. However, if you want
to use a different OID to distinguish the certificate you want GlobalProtect
to select, you can specify a different certificate usage when you
create the certificate and then instruct GlobalProtect to select
the certificate with the corresponding OID. Some of the most commonly
used OIDs are:
220.127.116.11.18.104.22.168.5—IPSec End System
say your endpoints have four client certificates installed, but
the one you want your users to select has the OID 22.214.171.124.126.96.36.199.1.
Rather than having the GlobalProtect app to present all four client
certificates to the user, you can specify the
Key Usage OID
in the GlobalProtect portal
app configuration for the users whose endpoints have multiple client
certificates. Keep in mind that if multiple client certificates
on the endpoint have the matching OID, GlobalProtect will prompt
the user to select the client certificate from the filtered list.
uses only the Extended Key Usage OID field of the certificate and
does not evaluate any other certificate fields such as Subject Name to
determine whether to present the certificates. Note that the Extended
Key Usage OID value is different from the Certificate Template Information
OID. For other certificate selection requirements, see How Does the App Know Which Certificate to Supply?
configure the OID as a requirement for certificate selection:
) Create or edit the client
certificate and note the associated OID.
Open the Certificate Templates snap-in.
In the Details pane, create or edit the certificate
template you want to modify, and then click Properties.
In the Edit Application Policies Extension dialog
In Add Application Policy, ensure that the application
you are creating does not exist, and then click
In the New Application Policy dialog box, provide
the name for the new application policy (for example GlobalProtect
Note the generated object identifier, and then click