topic Re: VPN cert connecting GAiA Portal, not server.crt in Firewall and Security Management

VPN cert connecting GAiA Portal, not server.crt

saitoh — Tue, 10 Sep 2024 08:13:14 GMT

Hi all,

My CP VM R81.20 gives my browser VPN cert when connecting GAiA Portal.

I surmise it should be server.crt since it is included in /web/ subdirectory.

I heard from some version CP has changed its design and now VPN cert has only a year of validity.

However I have never got to see any case where a user is unable to access GAiA Portal.

(guess this is because validity does not matter anyway since this is mostly accessed internally, user ignoring ssl warning...)

Plus, my boss said to me that he has experienced the case where CP shows server.crt in accessing GAiA Portal.

Quick google search tells me that I can choose which certificate to present as web server.

my misgiving here is:

1. Is it expected for CP to bring VPN cert for validating itself as a web server?

2. In my little experience I assume VPN cert is not to be updated unless Site to Site VPN Blade is enabled.

After expiration which certificate would httpd choose to present, or does it stop working?

Re: VPN cert connecting GAiA Portal, not server.crt

saitoh — Tue, 10 Sep 2024 06:48:38 GMT

P.S.

I forgot to add I observed this in R81.20 appliance and open server as well.

Re: VPN cert connecting GAiA Portal, not server.crt

PhoneBoy — Tue, 10 Sep 2024 14:01:18 GMT

How are you validating it’s the VPN certificate, exactly?
You might be seeing a different certificate because of MultiPortal.
Bottom line: yes, you can change the certificate.
https://support.checkpoint.com/results/sk/sk97648

Re: VPN cert connecting GAiA Portal, not server.crt

saitoh — Wed, 11 Sep 2024 00:11:08 GMT

Hi PhoneBoy,

Thanks for you reply.

I validated CP is showing VPN certificate by referring cert viewer of google chrome.

I did not know of Multi Portal.

I will self-search sk for the information on it by myself.

Saitoh

Re: VPN cert connecting GAiA Portal, not server.crt

saitoh — Wed, 11 Sep 2024 07:12:08 GMT

One of my co-worker found out how VPN cert is selected for GAiA Portal.

When VPN Blade is OFF, server.crt is selected, the validity term of which is for 10 years.

On, GAiA Portal brings VPN cert to browser, whether it is expired or not.

My question remains unsolved...

It is like server.crt is replaced according to the status of VPN blade.