topic Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format in Firewall and Security Management

Configuration of MTA SMTP/TLS Connection | Which Certificate Format

marius_kade — Wed, 29 Jan 2025 15:58:29 GMT

Hi Everybody

I want to set up the SMTP/TLS configuration with a certificate on our Checkpoint cluster under MTA.

I have summarized the certificate in a .p12, as this is the file type Checkpoint wants. At least it can only be uploaded as .p12.
I have executed the following command:
openssl pksc12 -export -out cert.p12 -inkey key.pem -in fullchain.pem

Then the password query appears and I have tried everything. Even with a two-digit password that I have entered correctly, the import always fails with this error message:

Is there something wrong with the format that I need to be aware of?

Thanks for your help!
Marius

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

AkosBakos — Wed, 29 Jan 2025 16:45:18 GMT

Hi @marius_kade

What is the version? R81.20 take ?

Here is an sk: https://support.checkpoint.com/results/sk/sk123237

"Failed to import outbound certificate. Check that the certificate's format is suitable and that the correct password has been entered"

Maybe you are under take 70.

Akos

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

marius_kade — Wed, 29 Jan 2025 17:08:33 GMT

Hi @AkosBakos ,

thanks for your reply. 🙂

We are currently on R81.10 Take 150
But i can see in Take 152 the problem may be solved. I will check if my certificate is using SHA 256 hashing algorithm tomorrow and maybe do an update to Take 152.
I will come back and report.

Thanks,
Have great day!

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

AkosBakos — Wed, 29 Jan 2025 17:36:37 GMT

Hi @marius_kade

Great, but I suggest you to consider the upgrade 🙂

Akos

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

PhoneBoy — Thu, 30 Jan 2025 03:26:08 GMT

Have you verified the .p12 file contains all the relevant information?
It should contain the private key and the entire (public) certificate chain (CA and all intermediates).

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

marius_kade — Thu, 30 Jan 2025 10:22:16 GMT

Yes, the .p12 contains the certificate, key and fullchain.
Creted with this command:
openssl pksc12 -export -out cert.p12 -inkey key.pem -in fullchain.pem

Inside the fullchain.pem are these certificates in this order:
cert - intermediate1 - intermediate2 - root(CA)

Thanks!

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

PhoneBoy — Thu, 30 Jan 2025 15:06:26 GMT

Looks like this may be the issue: https://support.checkpoint.com/results/sk/sk123237
Upgrade to JHF 152 or above.

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

marius_kade — Fri, 31 Jan 2025 11:48:46 GMT

The Certificate is in SHA256.

I will do the Update to Take 172 and try again after this.

Thanks for your help! 🙂

Re: Configuration of MTA SMTP/TLS Connection | Which Certificate Format

marius_kade — Fri, 31 Jan 2025 15:29:36 GMT

It's all done and worked after the update.
Many thanks and have nice weekend to both of you! 😄