topic Re: LDAPS Fingerprints and Proxy in Firewall & Security Management

LDAPS Fingerprints and Proxy

John_Richards — Wed, 17 Aug 2022 20:47:01 GMT

Our client has a SMS server in Azure in it's own segregated network. It manages both on-site and Azure GW's with no issue (communicates via the Azure public IP). They were using LDAPS for VPN authentication which was working fine. It appears that the fingerprints changed on the AD servers and we need to update them on the SMS. Normally the SMS does not need to communicate with AD, just the GW's, but apparently the SMS does have to communicate when updating the Fingerprints. We tried to enable "Management Server needs proxy to reach AD server" but this did not help with the Fingerprints. Does anyone know how you can update the Fingerprints if the SMS cannot talk to AD directly? We turned off LDAPS, pushed policy, and the users could authenticate using AD. Turn on LDAPS and it fails.

Re: LDAPS Fingerprints and Proxy

PhoneBoy — Tue, 23 Aug 2022 19:50:43 GMT

I would think you could update the fingerprint manually with the correct value.
Might be worth a TAC case to ask if there's a way to do that.

Re: LDAPS Fingerprints and Proxy

Tobias_Moritz — Mon, 05 Sep 2022 11:19:46 GMT

Yes, you can update it manually. What Check Point expects here, is the MD5 fingerprint of the LDAP server cert. You can query it manually from a client which can reach the LDAP server using openssl. When running from the gateway (Gaia Expert Shell), use cpopenssl instead of openssl:

LDAP with Start-TLS:

echo | openssl s_client -connect servername:389 -starttls ldap | openssl x509 -noout -fingerprint -md5

LDAPS:

echo | openssl s_client -connect servername:636 | openssl x509 -noout -fingerprint -md5

In case you don't want/need certificate pinning and let the gateways just accept any LDAP server cert, you can leave the fingerprint string input field empty. Never tried it myself, but another CheckMate recently confirmed this is working.

Re: LDAPS Fingerprints and Proxy

JozkoMrkvicka — Mon, 05 Sep 2022 20:10:57 GMT

If the fingerprint is empty (blank) the firewall will accept all fingerprints. It is like "any" in rule 😄 and works perfectly. You dont need to fetch new fingerprint once cert on LDAP is changed.

Re: LDAPS Fingerprints and Proxy

John_Richards — Tue, 06 Sep 2022 15:42:45 GMT

I have attached a screen shot of the configuration for LDAPS. So to be clear, you are saying the I do not need anything in the Fingerprints area? I would enable "Use Encryption (SSL), clear the information in the Fingerprints box, save and push policy?

Re: LDAPS Fingerprints and Proxy

Piet_vd_Maas — Tue, 06 Sep 2022 17:34:29 GMT

You can leave the Fingerprint blank even using SSL

Re: LDAPS Fingerprints and Proxy

JozkoMrkvicka — Tue, 06 Sep 2022 20:07:01 GMT

Yes.

Re: LDAPS Fingerprints and Proxy

John_Richards — Sat, 10 Sep 2022 19:58:17 GMT

So I was able to clear the fingerprint field and enabled ldap-ssl. Users can now change their passwords using VPN. The odd thing is I see a few ldap-ssl connections using port 636 from the FW to the DC in the logs. Then I see users authenticating to VPN and the port is 389 (not 636). Is this normal or is there a way to force the authentication to use ldap-ssl? Thanks

Re: LDAPS Fingerprints and Proxy

JozkoMrkvicka — Fri, 16 Sep 2022 05:36:14 GMT

How many LDAP servers are you using for redundancy ? You can configure many LDAP servers and every LDAP server can use different LDAP port (636 or 389). Check your LDAP Account Units for this one.

If LDAP with highest priority is not answering, second one in priority list is contacted.

Re: LDAPS Fingerprints and Proxy

John_Richards — Fri, 16 Sep 2022 15:26:50 GMT

All servers are set to use ldap-ssl and there are only 2 servers. I am meeting with CP on Monday to discuss and get more information. Will provide an update.

Re: LDAPS Fingerprints and Proxy

John_Richards — Mon, 10 Oct 2022 15:20:37 GMT

I finally met with an Identity Awareness expert on this. Basically using LDAP-SSL creates a tunnel back to AD and all auth goes over this tunnel. You will still see regular LDAP traffic. MS does claim that the fingerprint should rarely, if ever change. This is not what we see with our customers who use LDAP-SSL and Identity Awareness. Would be nice if Check Point would document "NOT" needing the fingerprint along with a good explanation as to why.

Re: LDAPS Fingerprints and Proxy

Matt_Taber — Wed, 19 Oct 2022 13:13:37 GMT

Thank you for this. We had written a script to check LDAPS cert fingerprints in policy to what the servers were presenting and then alert when there's a mismatch. Before we knew this was happening, we were down to 1 DC (out of 6) that didn't have a fingerprint mismatch. IA was on the brink of disaster. Good to know we can just *NOT* have a fingerprint in there.

Re: LDAPS Fingerprints and Proxy

Agent_Smith — Fri, 14 Mar 2025 14:14:20 GMT

I'm trying to setup LDAPS, LDAP works fine. I got off the phone with CP support and they said not to do what everyone here is suggesting of accepting any fingerprint. But also my LDAPS isn't working and it won't fetch the settings. We are using a self-signed cert so I'm not sure if that makes a difference.