Register for part 2 of our Device Identity Webinar Series!

Add verified device identity to Palo Alto GlobalProtect

GlobalProtect validates the client certificate presented at connection. Smallstep strengthens the issuance side: approved device inventory, TPM and Secure Enclave-backed keys where the client supports them, and renewal on supported clients. Keep GlobalProtect as your VPN enforcement point while improving assurance over which devices receive credentials.

Get a demo
background gradientbackground texture
Documented for GlobalProtect on PAN-OS
Issued only to approved inventory
TPM and Secure Enclave keys where supported
Certificate-only VPN sign-in
Windows, macOS, Linux
Automated renewal on supported clients

GlobalProtect checks the certificate. Smallstep decides which devices get one.

A certificate profile validates the client certificate against the CA you import, not how the device obtained it. AD CS and MDM deployments can use non-exportable or hardware-backed keys; what they assure depends on how enrollment, key protection, and device authorization are configured. Smallstep combines hardware-backed enrollment where supported, an approved device inventory, and lifecycle management in one issuance path.

  • Portal, gateway, HIP, and policy stay. Deployment adds the agent, a Smallstep credential, CA import, a certificate profile, authentication profile changes, and OCSP.

GlobalProtect setup guide

GlobalProtect integrates with Smallstep at two points

First, on PAN-OS: import the Smallstep root and intermediate, create a certificate profile that reads the user from the common name, and apply it to the portal and the gateway; each performs its own check. Second, on the device: the Smallstep agent places the certificate where the GlobalProtect client already looks, the machine store on Windows, a CryptoTokenKit identity on macOS, and files on Linux. The agent does not configure the client.

Hardware-bound keys where the client can use them

On Windows the key lives in the TPM and the certificate in the machine store, which the client searches by default. On macOS the key is in the Secure Enclave. Linux is a choice: the official client accepts only a PKCS#12 software key and needs a re-import after each renewal; OpenConnect uses a TPM 2.0 key but is a third-party client Palo Alto does not support, so validate HIP behavior and support implications first.

Certificate sign-in, with revocation the firewall checks over OCSP

The client selects the certificate and connects without a prompt. That proves possession of an authorized credential, not a fresh user login; to require a user login as well, set the OR setting to No with a working authentication profile. With active revocation, the firewall checks OCSP (not CRL on PAN-OS 12.1) and caches each answer for up to 24 hours, so revocation is not immediate and does not end existing tunnels.

Smallstep manages issuance. GlobalProtect controls access.

Smallstep authorizes enrollment from your inventory and issues the certificate. The portal and gateway each validate it; the gateway applies HIP and security policy to the session. Smallstep is not in the tunnel path.

GlobalProtect owns authentication, HIP, and policy. Smallstep owns which devices get a credential and how its key is protected.

Example: Intune-managed laptops enroll through the agent; the portal and gateway trust the Smallstep CA, check OCSP, and connect without a prompt.

How device identity and key protection work

Key benefits for GlobalProtect customers

Certificates for authorized devices

Smallstep checks inventory and enrollment policy before issuing. Devices outside your policy cannot obtain those credentials; GlobalProtect then enforces access with its certificate profile and security policy.

Hardware attestation where it exists

TPM keys on Windows, Secure Enclave-backed keys on macOS, with attestation level by platform. On Linux only OpenConnect uses a TPM key; the official client uses a software key. Key attestation is not device posture.

Keep GlobalProtect as the enforcement point

Add Smallstep-issued certificates to your certificate profile on PAN-OS, or on Prisma Access after validation, without replacing the client, the portal, HIP, or your security policy.

Passwordless VPN access where policy allows

Enrollment, issuance, and renewal happen through the agent. The client picks the certificate and connects; where policy needs a second factor, a working authentication profile with the OR setting at No adds a user prompt.

One identity, more than one enforcement point

The same device identity can serve Wi-Fi, SSO, SSH, and internal application integrations, each with its own credential configuration and enforcement on the resource side.

Lifecycle that follows inventory

Renewal before expiry on Windows, macOS, and OpenConnect; issuance stops when a device leaves inventory. Revocation reaches the firewall through OCSP, after its cache expires.

Put issuance assurance behind the GlobalProtect policies you already run.

Your portal and gateway keep deciding who connects. Smallstep governs which devices receive a certificate and how its key is protected.

Book a demo

FAQs Smallstep for Palo Alto GlobalProtect

GlobalProtect's certificate profile validates a certificate against the CA you import, with optional checks for expiry, unknown status, and revocation. It does not evaluate how the device obtained the certificate or where the key lives. AD CS and MDM SCEP can issue non-exportable or TPM-backed keys when configured that way; they can also enforce enrollment policies. Smallstep adds an explicit device approval and attestation workflow that ties issuance and renewal to device inventory and policy; how much that changes depends on the controls already configured in your existing PKI. Smallstep checks device approval and attestation status before issuing, according to the configured enrollment and issuance policy, and uses TPM and Secure Enclave keys where the GlobalProtect client can use them.

Import the Smallstep root and intermediate certificates, create a certificate profile with the username field set to the subject common name, and attach it to the portal and the gateway, each with a placeholder authentication profile and "Allow Authentication with User Credentials OR Client Certificate" set to Yes. The portal and gateway each check the certificate. On the Smallstep side, create a credential and a VPN configuration through the API; the setup guide gives the exact calls, including the vendor field workaround, since the API has no Palo Alto value.

With the placeholder no-auth profile from the guide, yes: the certificate alone satisfies the portal and gateway. That verifies possession of an authorized credential issued to an approved device. Hardware binding adds protection where supported, but it does not prove that the assigned user is the person at the keyboard; anyone with usable access to the device can connect under the identity in the certificate, and disabling that user in your IdP does not block this path. Where that matters, require both: configure a working LDAP, RADIUS, or SAML authentication profile and set "Allow Authentication with User Credentials OR Client Certificate" to No on the portal and on the gateway. Yes means either one is sufficient, so adding SAML while leaving the setting at Yes does not enforce two factors; a password alone would still connect.

Windows: the GlobalProtect client reads the certificate from the machine store; the key is in the TPM through a CNG key storage provider. macOS: the client uses a CryptoTokenKit identity managed by the Smallstep agent, with the key in the Secure Enclave. Linux: the official GlobalProtect client accepts only a PKCS#12 file and keeps the key in software; OpenConnect supports the GlobalProtect protocol and TPM 2.0 keys, but Palo Alto does not support clients that emulate GlobalProtect, so HIP behavior and vendor support differ. iOS and Android are not covered by the guide.

It has no key source other than an imported .p12 or .pfx file: no PKCS#11, no OpenSSL engine or provider, no NSS database. A TPM key cannot be exported to a file, so a Smallstep credential for this client must use a software key without attestation. The agent writes the PKCS#12 and its password; after each renewal the file must be imported again. If hardware-bound Linux VPN access matters, OpenConnect with the agent's TPM 2.0 key file is the alternative; it needs a hardware TPM and an OpenConnect build with TPMv2 support, and it is a third-party client outside Palo Alto support. Choose per fleet: native client with a software key, or OpenConnect with a TPM key.

Prisma Access uses the same GlobalProtect certificate profile model, configured in Panorama or Strata Cloud Manager rather than on a firewall. The setup guide documents PAN-OS 12.1; the client-side behavior is the same. Validate the certificate profile steps in your Prisma Access management plane with us before rollout.

Pre-logon requires a machine certificate the client can use before any user signs in, with the certificate profile's username field set to None. The Smallstep agent issues credentials after device enrollment and runs as a system service, but pre-logon with Smallstep certificates has not been validated. Treat it as an open item and test it in a pilot before depending on it.

It is a device credential that carries a username. The key belongs to the device; the common name is the email of the user assigned to that device in Smallstep inventory, the serial number if no user is assigned, or a fixed unknown-device value if the device has neither. The certificate profile reads the username from that field, so GlobalProtect treats the session as that user without a user login. Require an assigned user for user-based VPN access, and make sure certificates carrying a serial number or the fallback value cannot receive user-level privileges.

Enable active revocation on the authority and select Use OCSP in the certificate profile, with blocking of expired and unknown status. Do not select Use CRL: PAN-OS 12.1.5 cannot read the Smallstep CRL and returns unknown for every certificate. The responder reports a revocation within seconds, but the firewall keeps each OCSP answer until its next-update time, 24 hours for Smallstep, so a certificate it already saw as valid keeps working until it asks again; the guide gives the commands to clear both caches. If the responder is unreachable, behavior follows the "block if status cannot be retrieved" option, and after five failures the firewall stops asking for an hour. Revocation does not terminate an established tunnel.

Remove the device from inventory, by removing it from the MDM or in Smallstep, and issuance and renewal stop; the certificate runs to expiry unless revoked and the certificate profile checks revocation. Revoking the certificate reaches the firewall only after its OCSP cache expires, up to 24 hours. For containment sooner than that, use PAN-OS controls together: clear the OCSP caches so the firewall sees the revocation, then disconnect the session on the gateway; disconnecting alone allows reconnection while the cached status is valid. HIP quarantine blocks the device independently. Disabling the user in your IdP does not block the certificate-only path. Removal from inventory does not revoke or end an existing certificate by itself.

Yes. HIP collection, HIP-based security policy, and quarantine are unchanged; Smallstep is not a HIP source and does not replace them. Device identity and posture are separate questions, and GlobalProtect continues to answer the second one. The official client collects HIP natively. OpenConnect can submit HIP reports through an external script, which is not equivalent native posture collection and carries no Palo Alto support; validate posture enforcement before relying on it.

Some GlobalProtect client versions do not accept ECDSA server certificates on the portal; if the client aborts the handshake, issue an RSA server certificate for the portal. On Windows, keep the default certificate store lookup unless a user-store certificate from the same CA exists, in which case restrict lookup to the machine store.

No. This page is about using Smallstep certificates inside GlobalProtect's own authentication. Smallstep also offers Enterprise Relay for specific internal destinations that must be reachable only from attested devices, as an option alongside your VPN, not a prerequisite for the integration above.

Smallstep can extend device identity beyond the VPN to supported Wi-Fi, SSO, SSH, and internal application integrations. Each needs its own credential configuration and enforcement on the resource side; for example, Smallstep can act as an additional device identity factor in supported Okta or Entra sign-in flows.

Smallstep can extend device identity beyond Cloudflare to supported Wi-Fi, VPN, SSO, SSH, and internal application integrations. Each needs its own credential configuration and enforcement on the resource side; for example, Smallstep can act as an additional device identity factor in supported Okta or Entra sign-in flows.