topic Re: HTTPS Ispection - Certificate Validation Failure in Firewall and Security Management

HTTPS Ispection - Certificate Validation Failure

Ale_G — Thu, 05 Mar 2026 11:52:12 GMT

Hello all,

for the past few days (especially on government websites) we have been experiencing problems with web browsing. The error shown in the logs is the following:"

Certificate chain is inconsistent. Refer to sk159872 for more details.
Certificate DN: 'CN=*.fondimpresa.it,O=FONDIMPRESA,ST=Roma,C=IT' Requested Server Name: pf.fondimpresa.it.

Unhandled critical extension. Refer to sk159872 for more details.
Certificate DN: 'CN=domiciliodigitale.gov.it,O=Agenzia per l'Italia Digitale,L=Roma,ST=Roma,C=IT' Requested Server Name: domiciliodigitale.gov.it.

HTTPS isp option:

Public root certificates are present.

Can someone help me understand the reason and help me resolve the issue?

Many thanks,

Alessandro

Re: HTTPS Ispection - Certificate Validation Failure

the_rock — Thu, 05 Mar 2026 16:33:11 GMT

Hey Alessandro,

Did you try bypassing any of those sites as a test?

Re: HTTPS Ispection - Certificate Validation Failure

CaseyB — Thu, 05 Mar 2026 17:52:10 GMT

Have you installed the CRL fix released this week? sk184766

Re: HTTPS Ispection - Certificate Validation Failure

Lesley — Thu, 05 Mar 2026 17:57:56 GMT

This website uses incomplete cert chain, see SSL labs results:

https://www.ssllabs.com/ssltest/analyze.html?d=pf.fondimpresa.it&hideResults=on

You need to add the missing inter certs in your server config. So add full chain all but not the root cert! Then you get anchor issues in ssllabs.

If you do not manage this website try to add the missing certs into the cp same as you update the CA list.

https://support.checkpoint.com/results/sk/sk64521

Re: HTTPS Ispection - Certificate Validation Failure

emmap — Fri, 06 Mar 2026 00:54:39 GMT

Yes do this first, it's what resolved the issue for me.

Re: HTTPS Ispection - Certificate Validation Failure

Ale_G — Fri, 06 Mar 2026 11:34:49 GMT

Yes, I tried to bypass HTTPS inspection and everything works.

Re: HTTPS Ispection - Certificate Validation Failure

Ale_G — Fri, 06 Mar 2026 11:37:25 GMT

Only now I’ve noticed that a popup appeared in SmartConsole mentioning a CRL validation issue.

I’ll try updating the system and will give you feedback.

Thank you

Re: HTTPS Ispection - Certificate Validation Failure

Ale_G — Fri, 06 Mar 2026 14:10:42 GMT

Before doing that, I will install the CRL fix released this week, as suggested by @the_rock.

If this fix does not resolve the issue I will try to follow the steps you suggested.

Thank you!

Re: HTTPS Ispection - Certificate Validation Failure

Ale_G — Mon, 09 Mar 2026 12:20:01 GMT

I tried installing the fix, but it seems the problem hasn’t been resolved.

Re: HTTPS Ispection - Certificate Validation Failure

emmap — Tue, 10 Mar 2026 01:03:41 GMT

Did you install it on both management and gateways?

Re: HTTPS Ispection - Certificate Validation Failure

Ale_G — Tue, 10 Mar 2026 09:01:25 GMT

No, I've installed the fix only on the management server. Our gateways are running version R81.20, and there is no fix available for these appliances in the KB.

Re: HTTPS Ispection - Certificate Validation Failure

emmap — Tue, 10 Mar 2026 11:08:21 GMT

Hmm, ok, in my case it's R82 gateways and R82.10 SMS.

Try running 'cpca_client recreate_crls' on the management server. When I did this I didn't have any interruption to anything so it seems to be safe.