topic Re: Untrusted Certificate in Firewall and Security Management

Untrusted Certificate

johnyb — Sat, 11 Sep 2021 07:51:49 GMT

Hi Mates!

We have recently discovered that the certificate from "AnyNet Relay" (Anydesk) cannot be validated and we receive "Untrusted Certificate" from https inspection.

From SSL Server Test we downloaded the certificate and uploaded to the gateway but still we get the same behavior.

Since we must categorize the application properly what is your suggestion to overcome the issue?

Many Thanks,

Re: Untrusted Certificate

PhoneBoy — Sat, 11 Sep 2021 17:01:13 GMT

The Certificate Authority that signs the AnyDesk certificate must be uploaded to the trusted CA store.
Instead of updating the entire list as shown here, you’ll “add” one: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64521&partition=Basic&product=HTTPS

If this is a self-signed cert, you’ll upload the public key.
If this key is signed by a sub-CA, then the entire certificate chain must be uploaded.

Re: Untrusted Certificate

johnyb — Sat, 11 Sep 2021 18:09:40 GMT

Actually this is what i'm trying to do , to get the chain and upload it through "Import Outbound ...."

Pushing the policy to security gateway and still getting the same issue.

Not sure what is the issue afterall.

Re: Untrusted Certificate

PhoneBoy — Sat, 11 Sep 2021 20:15:35 GMT

What is the exact error you are getting and where?
Screenshots along with the version/JHF level would be helpful.

Re: Untrusted Certificate

johnyb — Sun, 12 Sep 2021 03:49:42 GMT

R80.40 take 294 (both nodes of the cluster)

Re: Untrusted Certificate

PhoneBoy — Sun, 12 Sep 2021 05:25:46 GMT

Did you perform the steps mentioned in the SK referenced in the log message?
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk159872

Re: Untrusted Certificate

johnyb — Sun, 12 Sep 2021 05:34:18 GMT

Yes indeed ...

Download the certificate chain of the abovementioned hostname from https://www.ssllabs.com/ssltest/

uploaded through "Import Outbound ...." and push the policy.

But the issue remains!

Re: Untrusted Certificate

afhill — Mon, 22 Aug 2022 14:26:44 GMT

Hi,

Same problem over here, version R81. Suggestions?