topic Re: How to Renew Certificate on Security Gateway. in Firewall and Security Management

How to Renew Certificate on Security Gateway.

AVG132 — Thu, 23 Mar 2023 11:52:40 GMT

Hi All ,

We are having a Security gateway whose certificate is about to expire in 15 days .It was issued by Security Management Server 5 years back. 1.What is a procedure to update this certificate .We are not planning to use external/internal separate CA for this .

2.Is there any impact if this certificate gets expired ?

3.Is there any SK article for this ?

Re: How to Renew Certificate on Security Gateway.

Tal_Paz-Fridman — Thu, 23 Mar 2023 14:38:16 GMT

An expired certificate will mean VPN will fail.

Edit the Security Gateway object.

Re: How to Renew Certificate on Security Gateway.

AVG132 — Thu, 23 Mar 2023 14:45:49 GMT

Thanks for reply . Is there any config changes required to be done at Security Management Server end as well ? What are next steps after clicking on Renew /will it renew automatically after this ?

Re: How to Renew Certificate on Security Gateway.

girisht — Fri, 24 Mar 2023 10:13:41 GMT

Hi there,

Renewing the IPSEC repository certificate will only impact the RA VPN and S2S VPN if the certificate is being used. So it would be advised to perform in lean hours. Once the certificate is renewed just push the policy.
Moreover, it doesn't require any changes on the MGMT server side and it will not renew automatically. An admin has to renew the certificate whenever it expires.
Additional info: sk176527

Re: How to Renew Certificate on Security Gateway.

the_rock — Fri, 24 Mar 2023 10:18:47 GMT

Just do what @girisht and @Tal_Paz-Fridman said. Btw, its totally safe to even do this in production hours, I had done it at least 20 times and never an issie. Now, to be safe, maybe better off hours, but you will be fine either way.

Also, dont forget to install policy afterwards.

Andy

Re: How to Renew Certificate on Security Gateway.

anand87 — Mon, 16 Jun 2025 09:30:36 GMT

thanks for the SK

Can we renew certificate in every 6 months instead of yearly

Re: How to Renew Certificate on Security Gateway.

PhoneBoy — Mon, 16 Jun 2025 18:14:19 GMT

You can manually "renew" and set the expiration for 6 months by modifying and executing the script here, which by default renews it for a year: https://support.checkpoint.com/results/sk/sk182070