HIP profile for certificate check with certificate attributes is not working as expected

• HIP profile for certificate check with certificate Attributes is not matching the respective user traffic.
• Certificate Attributes include subject, issuer etc.
• Respective HIP profile match being attached to the security policy and still HIP match logs not showing the user traffic.

• GlobalProtect HIP match
• HIP Match logs not displayed

• HIP Object to validate the Certificate check, with the certificate attribute value configured plainly as just the common name like below:

1. Check the exact value field of the subject and issuer in between the <value></value> from the HIP report with the below command. Replace the values to match your setup.

> debug user-id dump hip-report computer WIN2-10-MADHU ip 192.168.100.205 user lab\krishna

         

2. Navigate to Objects > GlobalProtect > HIP Objects > <hip-object> > Certificate
3. Use the complete value in the Value field as shown below: 

<entry name="subject"><value>/CN=client-cert</value>

</entry><entry name="issuer"><value>/CN=GlobalProtect</value>

       

4. For serial number you can check the following entry :

name="serial-no"><value>22F2A222</value><display-name>

• Along with the above, always verify if the correct certificate profile has been attached to the HIP Object for any kind of HIP log mismatch issues.