topic SCEP with fixed password does not work (SMB cluster) in Firewall and Security Management

SCEP with fixed password does not work (SMB cluster)

AkosBakos — Mon, 09 Aug 2021 15:28:24 GMT

Hi All,

I implemted a PoC enviroment at the customer, where I tested the issuing certificates from a 3rd party CA.

Windows server: 2012r2 as NDES server
CP SmartCenter: R80.40 JHF 118
SMB cluster R80.20 embedded Gaia

We want to use cert based S2S VPN.

Symptom: Requesting certificate for the SMB cluster with fix password does not work.

We got error message in NDES log:

ID 29: The password in the certificate request cannot be verified. It may have been used already. Obtain a new password to submit with this request.

Of course this password has never been used. We tried without password, and with one time passsword, both cases we got the certificate for the SMB cluster.

Until today I suppose that this is a windows side error.

Cisco FMC can cooperate with this CA/NDES without any problem. So this could be a CP side error

Somebody experienced such kind of behaviour?

Akos

Re: SCEP with fixed password does not work (SMB cluster)

PhoneBoy — Mon, 09 Aug 2021 15:33:05 GMT

Can you show screenshots of the step-by-step process you’re following?
I don’t see exactly where any of this is occurring on the Check Point side.

Re: SCEP with fixed password does not work (SMB cluster)

AkosBakos — Tue, 10 Aug 2021 09:26:37 GMT

I opened a TAC case.

I will update the community with the solution.

Akos

Re: SCEP with fixed password does not work (SMB cluster)

AkosBakos — Wed, 11 Aug 2021 14:15:03 GMT

Hi All,

We found the root cause of this issue.

The fix challenge password is 32 character long.

The OTP challenge password is 16 character long.

If I copy and paste the 32 characters long password into the SmartConsole, the last two characters cut off

I tested with the latest SmartConsole.

As a workaround, we set 16 character long password, and now it works fine.