https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271308#M103472 <P>From Ai Copilot:<BR /><BR /></P> <DIV class="ai-chatbot-conversation-assistant-text css-1m564fq"> <H2>R82 + Windows Server 2025 – LDAPS Connection Fails: Troubleshooting Guide</H2> <P>You are experiencing LDAPS (port 636) connection failures between Check Point R82 (Build 151) and Windows Server 2025, with the error:</P> <BLOCKQUOTE> <P>"Gateway could not connect to… Credentials are valid, but LDAP communication with the server failed." and<CODE>cpopenssl s_client -connect DC_FQDN:636<BUTTON></BUTTON></CODE>returns:<BR /><CODE>Verify return code: 21 (unable to verify the first certificate)<BUTTON></BUTTON></CODE></P> </BLOCKQUOTE> <P>You have already followed<SPAN>&nbsp;</SPAN><A href="https://support.checkpoint.com/results/sk/sk164834" target="_blank" rel="noopener">sk164834</A>. Here are additional troubleshooting steps and explanations based on Check Point documentation and best practices.</P> <HR /> <H3>1. Understanding the Error</H3> <UL> <LI><STRONG>Verify return code: 21 (unable to verify the first certificate)</STRONG><BR />This means the Check Point server cannot validate the certificate chain presented by the Domain Controller (DC). Most often, this is because the DC's certificate chain (including the Root CA and any intermediate CAs) is not trusted by the Check Point server.</LI> </UL> <HR /> <H3>2. Required Steps for LDAPS Trust</H3> <H4>A. Export the DC's Certificate Chain</H4> <OL> <LI> <P><STRONG>On the Domain Controller:</STRONG></P> <UL> <LI>Run: <PRE><CODE class="language-shell">certutil -store -v MY <BUTTON></BUTTON></CODE></PRE> </LI> <LI>Identify the certificate used for LDAPS (look for the one with the DC's FQDN as the CN).</LI> <LI>Export the full certificate chain (including the Root CA and any intermediates).</LI> </UL> </LI> <LI> <P><STRONG>Alternatively, from the Check Point server:</STRONG></P> <UL> <LI>Run: <PRE><CODE class="language-shell">cpopenssl s_client -connect &lt;DC_FQDN&gt;:636 <BUTTON></BUTTON></CODE></PRE> </LI> <LI>Copy the certificate text between<CODE>-----BEGIN CERTIFICATE-----<BUTTON></BUTTON></CODE>and<CODE>-----END CERTIFICATE-----<BUTTON></BUTTON></CODE>to a file (e.g.,<CODE>dc_cert.cer<BUTTON></BUTTON></CODE>).</LI> </UL> </LI> </OL> <H4>B. Import Certificates to Check Point</H4> <UL> <LI><STRONG>On both the Security Management Server (SMS) and Gateway:</STRONG> <OL> <LI>Copy the exported certificate files to the server.</LI> <LI>Import the Root CA and any intermediate CA certificates into the system's trusted store. <UL> <LI>For Gaia, use the WebUI:<BR /><EM>Home &gt; System Management &gt; Certificates &gt; Trusted CA</EM></LI> <LI>Or, for CLI: <PRE><CODE class="language-shell">cpca_client lscert -kind ICA # Import using cpca_client or system tools as appropriate <BUTTON></BUTTON></CODE></PRE> </LI> </UL> </LI> <LI>Restart Check Point services if required.</LI> </OL> </LI> </UL> <H4>C. Verify Certificate Trust</H4> <UL> <LI>After importing, re-run: <PRE><CODE class="language-shell">cpopenssl s_client -connect &lt;DC_FQDN&gt;:636 <BUTTON></BUTTON></CODE></PRE> <UL> <LI>The output should now show: <PRE><CODE>Verify return code: 0 (ok) <BUTTON></BUTTON></CODE></PRE> </LI> </UL> </LI> </UL> <HR /> <H3>3. Additional Troubleshooting</H3> <H4>A. Check for Stronger Authentication Requirements</H4> <UL> <LI>If you see errors about "LDAP_STRONG_AUTH_REQUIRED" or similar, check the DC's security policy: <UL> <LI>On the DC, run<CODE>secpol.msc<BUTTON></BUTTON></CODE></LI> <LI>Go to:<BR /><STRONG>Security Settings &gt; Local Policies &gt; Security Options &gt; Domain controller: LDAP server signing requirements</STRONG></LI> <LI>Set to<SPAN>&nbsp;</SPAN><STRONG>None</STRONG><SPAN>&nbsp;</SPAN>(for testing) or ensure your Check Point configuration supports signing.</LI> </UL> </LI> </UL> <H4>B. Confirm LDAPS Port and SSL Settings</H4> <UL> <LI>Ensure the correct port (636) is used and SSL is enabled in the LDAP Account Unit or Directory Scanner settings.</LI> </UL> <H4>C. Policy Installation</H4> <UL> <LI>After making changes, always<SPAN>&nbsp;</SPAN><STRONG>install policy</STRONG><SPAN>&nbsp;</SPAN>from SmartConsole to apply new settings.</LI> </UL> <H4>D. Certificate Fingerprint</H4> <UL> <LI>In SmartConsole, when configuring the LDAP Account Unit, use the "Fetch" button on the Encryption tab to retrieve and trust the DC's certificate fingerprint.</LI> </UL> <HR /> <H3>4. References</H3> <UL> <LI><STRONG><A href="https://support.checkpoint.com/results/sk/sk84620" target="_blank" rel="noopener">sk84620</A></STRONG>: How to configure Endpoint Security Server to connect to Domain Controller (DC) via LDAPS</LI> <LI><STRONG><A href="https://support.checkpoint.com/results/sk/sk109756" target="_blank" rel="noopener">sk109756</A></STRONG>: How to verify LDAP server Certificate Fingerprint obtained from the Domain Controller</LI> <LI><STRONG><A href="https://support.checkpoint.com/results/sk/sk148312" target="_blank" rel="noopener">sk148312</A></STRONG>: Authentication randomly fails when using Secure LDAP</LI> <LI><STRONG><A href="https://support.checkpoint.com/results/sk/sk104785" target="_blank" rel="noopener">sk104785</A></STRONG>: "Binding to LDAP server: Failed to check ssl" error</LI> </UL> <HR /> <H2>Summary Table</H2> <TABLE> <THEAD> <TR> <TH>Step</TH> <TH>Action</TH> </TR> </THEAD> <TBODY> <TR> <TD>Export Certificates</TD> <TD>From DC, export full chain (Root, Intermediate, DC cert)</TD> </TR> <TR> <TD>Import to Check Point</TD> <TD>Add to trusted CA store on SMS and Gateway</TD> </TR> <TR> <TD>Verify</TD> <TD>Use<CODE>cpopenssl s_client -connect &lt;DC_FQDN&gt;:636<BUTTON></BUTTON></CODE>and check for<CODE>Verify return code: 0<BUTTON></BUTTON></CODE></TD> </TR> <TR> <TD>Policy</TD> <TD>Install policy after changes</TD> </TR> <TR> <TD>Security Policy</TD> <TD>Check "LDAP server signing requirements" on DC</TD> </TR> </TBODY> </TABLE> <HR /> <H2>Final Notes</H2> <UL> <LI>This issue is not unique to Windows Server 2025; it is a common trust chain problem with LDAPS.</LI> <LI>If you have followed all steps and still see issues, double-check that the full certificate chain is imported and trusted.</LI> <LI>If you are using a lab CA, ensure the Root CA is not expired or revoked.</LI> </UL> <P>If you need step-by-step commands for importing certificates on Gaia, let me know your exact environment (SMS, Gateway, or both) and I can provide tailored instructions.</P> </DIV> <DIV class="css-1lj4tcw"> <DIV class="css-1ggc6ok"> <DIV>BE AWARE</DIV> </DIV> <DIV class="css-rtx1wd">Important - To prevent negative impact on your production environment, double-check the provided information in the Administration Guide for the involved product.</DIV> </DIV> <DIV class="ai-chatbot-references css-g9n3fs"> <DIV class="css-131f8vm">Learn more:</DIV> <DIV class="css-zs1iv6"> <OL class="css-3yupri"> <LI class="ai-chatbot-reference css-1onth16"><A class="css-a3bjub" href="https://sc1.checkpoint.com/documents/R82/SmartEndpoint_OLH/EN/Content/Topics-EPSG-R81.20/DirectoryScanner.html" target="_blank" rel="noopener">R82 Harmony Endpoint Server Administration Guide - DirectoryScanner</A></LI> <LI class="ai-chatbot-reference css-1onth16"><A class="css-a3bjub" href="https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_VSX_AdminGuide/Content/Topics-VSXG/Troubleshooting-General-Steps.htm" target="_blank" rel="noopener">R82 VSX Administration Guide - Troubleshooting-General-Steps</A></LI> <LI class="ai-chatbot-reference css-1onth16"><A class="css-a3bjub" href="http://support.checkpoint.com/results/sk/sk84620" target="_blank" rel="noopener">sk84620 - How to configure Endpoint Security Server to connect to Domain Controller (DC) via LDAPS</A></LI> </OL> </DIV> </DIV> Thu, 19 Feb 2026 13:06:58 GMT _Val_ 2026-02-19T13:06:58Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271149#M103397 <P>Hi,</P><P>In my lab environment I'm running:</P><UL><LI><P>Check Point R82 – Build 151</P></LI><LI><P>Distributed deployment</P></LI><LI><P>Windows Server 2025</P></LI><LI><P>LDAPS (port 636)</P></LI><LI><P>AD CS Enterprise Root CA</P></LI></UL><P><STRONG>Working:</STRONG></P><UL><LI><P>Port 636 reachable</P></LI><LI><P>I can browse AD structure in SmartConsole</P></LI></UL><P><STRONG>Failing:</STRONG></P><UL><LI><P>Connection attempts fails with:<BR /><EM>“Gateway could not connect to… Credentials are valid, but LDAP communication with the server failed.</EM></P></LI></UL><P>I have done the solution steps in&nbsp;sk164834.<BR /><BR />On both SMS and Gateway:</P><P>cpopenssl s_client -connect DC_FQDN:<SPAN class="">636</SPAN></P><P>Returns:</P><DIV class=""><DIV class=""><SPAN>Verify <SPAN class="">return</SPAN> code: <SPAN class="">21</SPAN> (unable to verify the first certificate)</SPAN></DIV></DIV><P>&nbsp;</P><P><STRONG>Question:</STRONG></P><P>Is anyone able to replicate this behavior on R82 with Windows Server 2025?<BR />Any tips on additional troubleshooting steps would be appreciated.</P><P>Thanks.</P> Wed, 18 Feb 2026 15:29:36 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271149#M103397 ghosty 2026-02-18T15:29:36Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271219#M103429 <P><a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/16383">@Vincent_Bacher</a>&nbsp;</P> <P>I believe you may had mentioned in one post you had this windows server 2025 in the lab? Apologies if I am mistaken. I spoke to Casper about this yesterday, but we dont sadly have that image in the lab, so cant set one up to test. Based on remote we did, Im 99.99% sure it is something on that server causing an issue, as we dont even see any drops or traffic even hitting the firewall. We even disabled native windows fw on the server, no joy.</P> Wed, 18 Feb 2026 14:57:34 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271219#M103429 the_rock 2026-02-18T14:57:34Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271223#M103430 <P>Please confirm the Jumbo take applied to the MGMT / gateways and version of IDC if used etc.</P> Wed, 18 Feb 2026 14:53:10 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271223#M103430 Chris_Atkinson 2026-02-18T14:53:10Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271224#M103431 <P>Well, you are in luck, my friend. I just checked and looks my colleague did upload windows 2025 image, so give me some time, will let you know in 1 hour tops if it works or not.</P> Wed, 18 Feb 2026 15:00:00 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271224#M103431 the_rock 2026-02-18T15:00:00Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271231#M103433 <P><a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/83701">@ghosty</a>&nbsp;</P> <P>Just set it all up, rebooted, disabled windows fw, exact same issue as you...let me keep working on it and see if I can fix it.</P> Wed, 18 Feb 2026 15:42:53 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271231#M103433 the_rock 2026-02-18T15:42:53Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271232#M103434 <P>I tested with any any allow rule, got exact same issue like you did Casper when we did remote yesterday, so thats how Im 100% sure its windows issue.</P> <P>Here is what I ran to make it work (found this after 10 mins on Google lol)</P> <P><SPAN><!--ScriptorStartFragment-->netsh advfirewall set allprofiles state off<!--ScriptorEndFragment--></SPAN></P> Wed, 18 Feb 2026 15:52:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271232#M103434 the_rock 2026-02-18T15:52:43Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271238#M103439 <P>This did not solve the issue for me, unfortunately.</P> Wed, 18 Feb 2026 16:46:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271238#M103439 ghosty 2026-02-18T16:46:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271239#M103440 <P>Just running the base version atm.</P> Wed, 18 Feb 2026 16:47:35 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271239#M103440 ghosty 2026-02-18T16:47:35Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271240#M103441 <P>I did reboot after doing it, mind you.</P> Wed, 18 Feb 2026 16:47:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271240#M103441 the_rock 2026-02-18T16:47:54Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271241#M103442 <P>Still didn't work after reboot <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 18 Feb 2026 16:54:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271241#M103442 ghosty 2026-02-18T16:54:09Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271243#M103444 <P>Sorry mate, I got nothing else then <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 18 Feb 2026 16:55:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271243#M103444 the_rock 2026-02-18T16:55:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271245#M103446 <P>No I just suggested some debugs.</P> <P>Any news about the issue ?</P> Wed, 18 Feb 2026 17:23:48 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271245#M103446 Vincent_Bacher 2026-02-18T17:23:48Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271246#M103447 <P>Got it, sorry, my bad then.&nbsp;</P> <P><a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/83701">@ghosty</a>&nbsp;, here is IA debugs I got from TAC while back.</P> <P># cd $FWDIR/log<BR /># rm pdpd.elg.*<BR /># echo "=debug_start=" &gt;&gt; $FWDIR/log/pdpd.elg<BR />(•) To turn pdp debug on:<BR /># adlog a d on<BR /># pdp debug on<BR /># pep debug on<BR /># pdp debug set all all<BR />(•) Replicate the issue<BR />(•) To turn them off:<BR /># adlog a d off<BR /># pdp debug unset all all<BR /># pdp debug off<BR /># pep debug off<BR /># pdp d reset<BR /># pep d unset all all<BR />Collect debug:<BR />$FWDIR/log/pdpd.elg<BR /># tar zcvf pdpd_debugs.tgz pdpd.elg*<BR /># tar zcvf pepd_debugs.tgz pepd.elg*</P> Wed, 18 Feb 2026 17:37:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271246#M103447 the_rock 2026-02-18T17:37:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271247#M103448 <P>Never good idea to run base version without jumbo take. What about IDC? Or you use AD query? Are you able to fetch the fingerprints and branches in the ldap account unit?&nbsp;</P> Wed, 18 Feb 2026 17:40:17 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271247#M103448 Lesley 2026-02-18T17:40:17Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271248#M103449 <P>Not sure if thats even related, but nevertheless, I always install latest jumbo in my lab the day it comes out.</P> Wed, 18 Feb 2026 17:42:30 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271248#M103449 the_rock 2026-02-18T17:42:30Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271250#M103450 <P>consider increasing the debug file size and number of rotations&nbsp;</P> Wed, 18 Feb 2026 18:09:58 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271250#M103450 Vincent_Bacher 2026-02-18T18:09:58Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271251#M103451 <P>Yes, good point, Vince.</P> Wed, 18 Feb 2026 18:17:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271251#M103451 the_rock 2026-02-18T18:17:54Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271277#M103454 <P>Hey Casper,</P> <P>Mind sending the output of services.msc from your lab windows? I want to compare it to mine, see if its different.</P> Thu, 19 Feb 2026 03:29:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271277#M103454 the_rock 2026-02-19T03:29:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271281#M103456 <P>Is this question&nbsp;"<SPAN>Are you able to fetch the fingerprints and branches in the ldap account unit? " answered?<BR />And are the debugs collected?<BR /><BR />Asking because in pdpd.elg you can clearly see all details about ldap communication and due to the error message in the starting post i would says pdpd.elg will be helpful to see any hints.</SPAN></P> Thu, 19 Feb 2026 06:49:01 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271281#M103456 Vincent_Bacher 2026-02-19T06:49:01Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271286#M103460 <P>Yes, fetch is working.<BR /><BR />Debug files are attached.</P> Thu, 19 Feb 2026 09:46:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R82-Windows-Server-2025-LDAPS-Connection-Fails/m-p/271286#M103460 ghosty 2026-02-19T09:46:20Z