topic Re: HTTPS Inspection Certificate Expired - No Warnings? in Firewall and Security Management

HTTPS Inspection Certificate Expired - No Warnings?

StackCap43382 — Mon, 25 Sep 2023 08:16:07 GMT

Hi All,

Just had to renew a HTTPS certificate that expired yesterday and caused an outage this morning.

I cant see any warning in the policy install, audit logs or logs and there is no mention in the ARTG etc.

I know better warnings about VPN Cert expiry has been added.

Am I missing something obvious?

Re: HTTPS Inspection Certificate Expired - No Warnings?

G_W_Albrecht — Mon, 25 Sep 2023 08:41:44 GMT

sk64521: How to update the Trusted Certificate Authorities (CAs) list for HTTPS Inspection and HTTPS Categorization

sk173629 - How to update Trusted CAs automatically

sk108641: How to renew, import, or export a new HTTPS Inspection certificate

Re: HTTPS Inspection Certificate Expired - No Warnings?

StackCap43382 — Mon, 25 Sep 2023 08:52:41 GMT

I don't see anything there about HTTPS Certificate expiration warnings.

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Mon, 25 Sep 2023 11:53:57 GMT

Im almost positive you dont get warning for that, at least I never seen it in any customer's environment or in multiple labs where I had it enabled (R80.30, R80.40, R81.10 and R81.20). You can certainly confirm with TAC, but Im 99.99% sure there is no warning pop-up for inspection cert.

I know, it would make total sense to receive it, but guess not there.

Andy

Re: HTTPS Inspection Certificate Expired - No Warnings?

StackCap43382 — Mon, 25 Sep 2023 12:37:13 GMT

I've also not seen anything going back to r77.30.

I've opened a case with TAC to be 100% sure.

I have noticed there is a API command in the latest 1.9.1 version of the MGMT API that appears you can extract HTTPS certificate details.

mgmt_cli show outbound-inspection-certificate
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-outbound-inspection-certificate~v1.9.1%20

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Mon, 25 Sep 2023 12:51:15 GMT

Correct, this is just in my lab, which also matches below screwenshot in legacy https inspection smart console. I believe max validity is 15 years.

Andy

valid-from: "14-Sep-23"
valid-to: "31-Dec-37"

Re: HTTPS Inspection Certificate Expired - No Warnings?

Martin_Raska — Tue, 26 Sep 2023 11:05:13 GMT

I had the same problem, my certificate expired after 5 years. No warnings either. I had to renew and set a long expiration date.

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Tue, 26 Sep 2023 13:54:06 GMT

Makes sense...I hope someone from Israel sees this post and they make that change, as I agree 100%, it would be very convenient to have warning at least 6 months in advance, thats more than enough time.

Andy

Re: HTTPS Inspection Certificate Expired - No Warnings?

StackCap43382 — Thu, 28 Sep 2023 10:48:39 GMT

Ticket Raised with TAC.

Confirmed no current method to monitor.

Requested to raise RFE.

In case anyone wants to use API to pull Cert Experation:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-outbound-inspection-certificate~v1.9%20

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Thu, 28 Sep 2023 11:33:46 GMT

I had been super busy with other more pressing CP issues, but still working on this, not giving up.

Andy

Re: HTTPS Inspection Certificate Expired - No Warnings?

matangi — Fri, 13 Oct 2023 22:01:03 GMT

Hi @StackCap43382,
Thanks for your valued feedback.

We introduced a new HealthCheck Point (HCP) test to verify the expiration date of the HTTPS Inspection outbound certificate.

The test will be included in an upcoming release of HCP.

The possible results for the test are as follows:

# SUCCESS - No issues detected. The certificate is valid and will not expire in the next 60 days.

# WARNING - The certificate will expire within the next 60 days.

# ERROR - Issues detected that need immediate action. The certificate is either expired or not yet valid.

Thanks,
Matan

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Fri, 13 Oct 2023 14:14:09 GMT

Thats perfect, good news @matangi

I pray you are safe over there and I pray for peace 🙌🙌

Andy

Re: HTTPS Inspection Certificate Expired - No Warnings?

StackCap43382 — Fri, 13 Oct 2023 14:22:54 GMT

Thank you for adding this to the HCP tool.

The issue is that I still consider HCP a power user tool as the vast majority of customers either don't know its there or run it often enough to pick up on this before its too late.

The alert/notification should require no manual action from the administrator (run the script) and should be a management notification.

There are several functions/faults that generate a popup on Smart Console login, this should be one of them.

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Fri, 13 Oct 2023 14:26:45 GMT

I really love the fact that web version was possible for HCP starting in R81.10

Below is what it looks like in my R81.20

Andy

Re: HTTPS Inspection Certificate Expired - No Warnings?

matangi — Sun, 15 Oct 2023 06:51:40 GMT

Thank you @the_rock 😍

Re: HTTPS Inspection Certificate Expired - No Warnings?

Izhar_Shoshani_ — Wed, 18 Oct 2023 15:05:19 GMT

We are working to integrate the hcp alert into the Mgmt/SmartConsole. This is planned for next version.

Re: HTTPS Inspection Certificate Expired - No Warnings?

the_rock — Wed, 18 Oct 2023 15:07:27 GMT

Great news @Izhar_Shoshani_