topic Re: Import existing client certificates and map to CheckPoint Management Server Admin Account in API / CLI Discussion

Import existing client certificates and map to CheckPoint Management Server Admin Account

Oscar_Medina1 — Mon, 23 Jul 2018 19:01:39 GMT

Hi Y'all,

I am trying to leverage any Azure capabilities that may help streamline the setup of administrator accounts for the management servers we have (currently 2 in two separate Azure Locations).

As of now, I've setup VPN (P2S) to our hub vNET which allows access to the Azure resources including those Management Servers. My VPN setup simply uses Certificates, so my root CA is stored in Azure Key Vault. I plan to distribute a different client certificate for each user who will administer the CheckPoint Management servers.

However, I see that CheckPoint SmartConsole (which I assume uses the API) allows for creating an account and includes the ability to create a certificate for said user. My question is; can I import an existing user certificate created on KeyVault and map it to a given administrator account via the CLI, if so, what would that look like? I checked the API and only saw the ability to create an administrator account using a password...

Any guidance is super appreciated,
@SharePointOscar

Re: Import existing client certificates and map to CheckPoint Management Server Admin Account

Robert_Decker — Mon, 23 Jul 2018 19:23:42 GMT

Hi Oscar,

SmartConsole doesn't use Management API for user object operations (accounts, certificates). It uses dedicated internal web services on CPM server.

In addition, currently there aro no commands in Management API to perform those operations.

Robert.

Re: Import existing client certificates and map to CheckPoint Management Server Admin Account

Oscar_Medina1 — Mon, 23 Jul 2018 19:53:39 GMT

Thanks https://community.checkpoint.com/people/rdeck5af054c0-4c71-4395-9c31-2a794ff5bc37 what about the ICA Management Tool? Seems to handle user cert operations?

Re: Import existing client certificates and map to CheckPoint Management Server Admin Account

Robert_Decker — Tue, 24 Jul 2018 08:41:47 GMT

Maybe, but I'm not familiar with the ICA Management Tool.