topic Re: SSL Self-Signed Certificate vulnerabily in Firewall and Security Management

SSL Self-Signed Certificate vulnerabily

lama — Tue, 16 Feb 2021 15:41:19 GMT

Hello,

the Nessus scanner shows vulnerabilities on to the gateways because they use self-signed certificates at the web gaia level.
I want to import certificates signed with our certifications authority, but I am not sure of the impact it will have on the infrastructure, for example at SIC level ...

Thanks a lot

Re: SSL Self-Signed Certificate vulnerabily

_Val_ — Tue, 16 Feb 2021 15:53:37 GMT

It is only vulnerability if you do not know who signed those certificates. No actual issue here

Re: SSL Self-Signed Certificate vulnerabily

lama — Tue, 16 Feb 2021 16:47:58 GMT

Thank you for you response

What is the impact if i import certificates signed with our certifications authority on the infrastructure( at SIC level ...)

Re: SSL Self-Signed Certificate vulnerabily

_Val_ — Tue, 16 Feb 2021 17:23:25 GMT

First, you do not want to change SIC certs, neither root, nor those issued. If you try, you will have to re-do all SIC with all GWs, not a good idea.

If your concern is SSL certs only, identify which exact portals are in need to be changed.

Re: SSL Self-Signed Certificate vulnerabily

lama — Tue, 16 Feb 2021 19:44:17 GMT

Thanks for your rwply.

All what i want to do is changing certs on gaia portal level and really don't want that to impact any other things like sic communication or cluster communication . If there is any doubt about that i will not do any change .

Re: SSL Self-Signed Certificate vulnerabily

PhoneBoy — Tue, 16 Feb 2021 20:39:12 GMT

To change the Gaia portal cert: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97648

To my knowledge, you cannot change ICA to use a third party CA.
Most portals exposed to users (as well as VPN) can be configured to use a certificate signed by a different CA.

Re: SSL Self-Signed Certificate vulnerabily

lama — Thu, 18 Feb 2021 09:32:38 GMT

Hello @PhoneBoy

Thank you very much for you reply,

I have one more question please, If i changed the Certificate used by platform portal, should i changed it for all other portals , since all portals on the same Security Gateway IP address use the same certificate ( https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_MobileAccess_AdminGuide/html_frameset.htm?topic=documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_MobileAccess_AdminGuide/23007 )

Re: SSL Self-Signed Certificate vulnerabily

PhoneBoy — Thu, 18 Feb 2021 21:29:36 GMT

You should be able to do that, yes.