topic Re: Notification of expiring VPN certificate in AI Network Firewall

Notification of expiring VPN certificate

nooni — Wed, 08 Mar 2023 10:55:28 GMT

Hi,

Just recently the expiration of VPN certificates was changed from 5-6 years down to 1 year to comply with a RFC.

This is good but can be a bit tricky since also Identity Awareness use this certificate, possibly also more services.

So for example if you use Identity Awareness but not VPN blade then you must temporarily enable VPN blade, check and/or renew certificate so it is valid for another year.

Is it possible to get an notification if before the certificate expires ?

I saw a previous discussion here on Check Mates, but that was when VPN blade is enabled.

Would be very useful if for example the cluster object got a warning sign a week or two before it happens.

Re: Notification of expiring VPN certificate

the_rock — Wed, 08 Mar 2023 11:40:00 GMT

As far as I know, you would get warning when pushing the policy about it 1 month before cert is to expire.

Re: Notification of expiring VPN certificate

Danny — Wed, 08 Mar 2023 11:51:41 GMT

That's perfectly possible. Just script a scheduled event on your SMS that checks the postgres monitoring database and generates an email alert whenever a warning is detected.

Example for R81.20: psql_client monitoring postgres -c "select * from statuses_view"

Re: Notification of expiring VPN certificate

matangi — Wed, 08 Mar 2023 12:54:47 GMT

Hi @nooni

In R81.20, New alert was added for that matter.

The Management Server begins to show 'warning' status starting 60 days before the certificate expiration date.

For more details, see sk178304 - SmartConsole shows a warning or error icon near the Security Gateway / Cluster object about an expiring VPN certificate.

Thanks,
Matan

Re: Notification of expiring VPN certificate

the_rock — Wed, 08 Mar 2023 13:28:13 GMT

Thats EXCELLENT change @matangi

Andy

Re: Notification of expiring VPN certificate

the_rock — Wed, 08 Mar 2023 14:07:26 GMT

Also, wanted to say, its GREAT to see now in web UI when you try download jumbo hotfix, if cpuse agent is not the latest version, pop-up window comes up asking to upgrade it.

AWESOME 👍👍👌👌

Re: Notification of expiring VPN certificate

freeman91 — Fri, 24 Jul 2026 07:11:21 GMT

Is there a way for this notification to be e-mailed? Like when I got a notification when CPU >90% or disk space <15% with this sk25941

Re: Notification of expiring VPN certificate

Chris_Atkinson — Fri, 24 Jul 2026 08:31:39 GMT

You can also monitor it via SNMP and have your monitoring system alert accordingly.

Re: Notification of expiring VPN certificate

freeman91 — Fri, 24 Jul 2026 08:38:14 GMT

Can you give me a bit more guide? I have only found these: where to find about ssl vpn certificate expiration?

Re: Notification of expiring VPN certificate

Chris_Atkinson — Fri, 24 Jul 2026 09:12:59 GMT

Example SNMP OIDs for Gateway monitoring:

1.3.6.1.4.1.2620.1.1.101.0 (Certificate status)
1.3.6.1.4.1.2620.1.1.102.0 (Status description - short)
1.3.6.1.4.1.2620.1.1.103.0 (Status description - long)

Re: Notification of expiring VPN certificate

freeman91 — Fri, 24 Jul 2026 09:15:00 GMT

Where I can configure this OIDs? Please be more detailed because i am not a pro 😞

Re: Notification of expiring VPN certificate

Chris_Atkinson — Fri, 24 Jul 2026 09:41:09 GMT

In your monitoring tool of choice e.g. Nagios or PRTG etc.

Re: Notification of expiring VPN certificate

freeman91 — Fri, 24 Jul 2026 09:47:25 GMT

Oh, I understand now. But there is not monitoring tools because this question is for several check point fws from diff clients and I need a way to monitoring ssl vpn cert for each of them.

I thing I can manage it via Smartevent when certain log appear.

Re: Notification of expiring VPN certificate

Chris_Atkinson — Fri, 24 Jul 2026 10:07:47 GMT

Playblocks also has an option:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Playblocks-Admin-Guide/Topics/alertonvpncertificatesexp/alert-on-vpn-certificates-expiration-on-quantum-gateway.html