为什么 I 在我的 PanGPS 日志中看到错误"Winhttp_callback_status_flag_invalid_ca"？
18530
Created On 12/17/20 18:38 PM - Last Modified 03/26/21 18:51 PM
Question
为什么 I 在我的 PanGPS 日志中看到错误"Winhttp_callback_status_flag_invalid_ca"？
(T3336) 07/17/20 10:17:31:134 Info (2257): winhttpObj, dwCertError is:
(T3336) 07/17/20 10:17:31:134 Info (2261): WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA
(T3336) 07/17/20 10:17:31:134 Info (2244): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=0000000001C34720)
(T3336) 07/17/20 10:17:31:134 Debug(2319): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5
(T3336) 07/17/20 10:17:31:134 Debug(3509): we get cert error, so remove previousCertificate
(T1724) 07/17/20 10:17:31:196 Debug(3469): send alive message now 3
(T704) 07/17/20 10:17:31:196 Debug( 504): Command = <request> <type>pan_msg_ping</type><result>3</result></request>
(T1724) 07/17/20 10:17:31:196 Info (1258): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR
(T1724) 07/17/20 10:17:31:196 Info (1260): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set
(T1724) 07/17/20 10:17:31:196 Error(1285): error = ERROR_WINHTTP_SECURE_FAILURE
(T3336) 07/17/20 10:17:31:134 Info (2261): WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA
(T3336) 07/17/20 10:17:31:134 Info (2244): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=0000000001C34720)
(T3336) 07/17/20 10:17:31:134 Debug(2319): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5
(T3336) 07/17/20 10:17:31:134 Debug(3509): we get cert error, so remove previousCertificate
(T1724) 07/17/20 10:17:31:196 Debug(3469): send alive message now 3
(T704) 07/17/20 10:17:31:196 Debug( 504): Command = <request> <type>pan_msg_ping</type><result>3</result></request>
(T1724) 07/17/20 10:17:31:196 Info (1258): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR
(T1724) 07/17/20 10:17:31:196 Info (1260): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set
(T1724) 07/17/20 10:17:31:196 Error(1285): error = ERROR_WINHTTP_SECURE_FAILURE
Environment
- GlobalProtect 基础 设施
- 基于证书的身份验证
- 窗口终结点
Answer
每当 SSL TLS 门户/网关/网关/配置文件中使用的服务器证书无效时，就会出现
A 此错误。
- CA用于签署服务器证书的根不安装在适当商店的端点（例如：用户和/或机器）
- 服务器证书已过期或具有不正确的属性（例如： SAN IP 或域名）
- SSL/ TLS 配置文件使用不正确的证书
Additional Information
有关部署时证书要求的其他信息 GlobalProtect ，请参阅以下文档：