VPN: Difference between revisions
iwu |
add openconnect |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
= Juniper Pulse Secure client = | |||
{{testedon|2020-04-22|CentOS 7.7.1908}} | |||
First, get the CA certificate file to get rid of the following error: | |||
<code>Server certificate verify failed: signer not found</code> | |||
<source lang="console"> | |||
echo -n | openssl s_client -connect vpn.myuniversity.edu:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/certs/myschool-vpn-cafile.crt | |||
</source> | |||
Then grab the --servercert sha256:whateverhexcodehere that shows up when you execute the following line: | |||
<source lang="console"> | |||
$ sudo openconnect --authgroup=colleges --user=skan --cafile=/home/skan/certs/myschool-vpn-cafile.crt --juniper https://vpn.myuniversity.edu | |||
</source> | |||
Disconnect using <code>ctrl-c</code> and then add the --servercert param: | |||
<source lang="console"> | <source lang="console"> | ||
$ sudo openconnect --authgroup=colleges --user=skan --juniper https://vpn.myuniversity.edu | $ sudo openconnect --authgroup=colleges --user=skan --cafile=/home/skan/certs/myschool-vpn-cafile.crt --servercert sha256:043c3a132f34d87ba8c507f21d775a08dc1d85aa3f2d782996d66d17865af2e0 --juniper https://vpn.myuniversity.edu | ||
</source> | </source> | ||
= openconnect = | |||
{{testedon|2024-07-10|Ubuntu 20.04 LTS}} | |||
To resolve the "Server certificate verify failed: signer not found" error when connecting to GlobalProtect VPN via openconnect, you need to update your system's trusted certificates to include the certificate authority (CA) that signed the VPN server's certificate. Here are the steps you can follow to obtain and update the server certificate: | |||
# Obtain the Server Certificate: | |||
You can obtain the server certificate using the openssl command. Run the following command to download the certificate: | |||
<syntaxhighlight lang="bash"> | |||
echo | openssl s_client -connect 129.24.2.245:443 -servername 129.24.2.245 | openssl x509 -text -noout > server.crt | |||
</syntaxhighlight> | |||
<ol start="2"> | |||
<li>Add the Certificates to Trusted CA Store:</li> | |||
</ol> | |||
<syntaxhighlight lang="bash"> | |||
sudo cp server.crt /usr/local/share/ca-certificates | |||
sudo update-ca-certificates | |||
</syntaxhighlight> | |||
<ol start="3"> | |||
<li>Since the certificate has been added to the trusted store, there is nothing more to do. However, in cases when it needs to be added manually:</li> | |||
</ol> | |||
<syntaxhighlight lang="bash"> | |||
sudo openconnect --cafile=/usr/local/share/ca-certificates/server.crt https://129.24.2.245 | |||
</syntaxhighlight> | |||
Latest revision as of 15:13, 10 July 2024
Juniper Pulse Secure client
- Last tested on CentOS 7.7.1908 (2020-04-22)
First, get the CA certificate file to get rid of the following error:
Server certificate verify failed: signer not found
echo -n | openssl s_client -connect vpn.myuniversity.edu:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/certs/myschool-vpn-cafile.crt
Then grab the --servercert sha256:whateverhexcodehere that shows up when you execute the following line:
$ sudo openconnect --authgroup=colleges --user=skan --cafile=/home/skan/certs/myschool-vpn-cafile.crt --juniper https://vpn.myuniversity.edu
Disconnect using ctrl-c and then add the --servercert param:
$ sudo openconnect --authgroup=colleges --user=skan --cafile=/home/skan/certs/myschool-vpn-cafile.crt --servercert sha256:043c3a132f34d87ba8c507f21d775a08dc1d85aa3f2d782996d66d17865af2e0 --juniper https://vpn.myuniversity.edu
openconnect
- Last tested on Ubuntu 20.04 LTS (2024-07-10)
To resolve the "Server certificate verify failed: signer not found" error when connecting to GlobalProtect VPN via openconnect, you need to update your system's trusted certificates to include the certificate authority (CA) that signed the VPN server's certificate. Here are the steps you can follow to obtain and update the server certificate:
- Obtain the Server Certificate:
You can obtain the server certificate using the openssl command. Run the following command to download the certificate:
echo | openssl s_client -connect 129.24.2.245:443 -servername 129.24.2.245 | openssl x509 -text -noout > server.crt
- Add the Certificates to Trusted CA Store:
sudo cp server.crt /usr/local/share/ca-certificates
sudo update-ca-certificates
- Since the certificate has been added to the trusted store, there is nothing more to do. However, in cases when it needs to be added manually:
sudo openconnect --cafile=/usr/local/share/ca-certificates/server.crt https://129.24.2.245