https://community.checkpoint.com/t5/Firewall-and-Security-Management/HTTPS-Inspection-and-Multiple-Ingress-Interfaces/m-p/272737#M103895 <P>Forked this into a new thread, given the age of the thread this was posted to.</P> <P>The answer is the number of ingress/egress interfaces shouldn't matter here.</P> <P>For outbound inspection (i.e. users browsing the Internet), the certificate is generated "on the fly" using the same DN, etc as the original certificate.<BR />Provided the end user trusts the gateway's CA, the certificate should validate.</P> <P>For inbound inspection (i.e. users from the Internet browsing YOUR servers), you're using either the original server certificate OR one that a random user on the Internet should be able to validate.<BR />Here, SANs might be useful (especially if the certificate serves multiple sites).&nbsp;</P> Fri, 06 Mar 2026 18:21:58 GMT PhoneBoy 2026-03-06T18:21:58Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/HTTPS-Inspection-and-Multiple-Ingress-Interfaces/m-p/272671#M103894 <P>Query -&nbsp; If I have a GW with HTTPs inspect enabled, but have multiple ingress interfaces that traffic needs to be inspected how does this work.<BR />I assume that when the CA certificate is generated this will have a FQDN, this FQDN would then be resolved by DNS, to an IP, so if the GW interface IP is different would this cause a problem?<BR /><BR />I've not seen an SK in order to create a CA certificate with SANs, or I could have tried that with multiple 'A' records in DNS.<BR /><BR /></P> Fri, 06 Mar 2026 18:15:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/HTTPS-Inspection-and-Multiple-Ingress-Interfaces/m-p/272671#M103894 genisis__ 2026-03-06T18:15:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/HTTPS-Inspection-and-Multiple-Ingress-Interfaces/m-p/272737#M103895 <P>Forked this into a new thread, given the age of the thread this was posted to.</P> <P>The answer is the number of ingress/egress interfaces shouldn't matter here.</P> <P>For outbound inspection (i.e. users browsing the Internet), the certificate is generated "on the fly" using the same DN, etc as the original certificate.<BR />Provided the end user trusts the gateway's CA, the certificate should validate.</P> <P>For inbound inspection (i.e. users from the Internet browsing YOUR servers), you're using either the original server certificate OR one that a random user on the Internet should be able to validate.<BR />Here, SANs might be useful (especially if the certificate serves multiple sites).&nbsp;</P> Fri, 06 Mar 2026 18:21:58 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/HTTPS-Inspection-and-Multiple-Ingress-Interfaces/m-p/272737#M103895 PhoneBoy 2026-03-06T18:21:58Z