topic Re: Import SSL certificate to Checkpoint SmartEndpoint in Endpoint

Import SSL certificate to Checkpoint SmartEndpoint

chethan_m — Thu, 13 Apr 2023 08:47:15 GMT

Hi All,

I need to integrate LDAP over SSL with my Checkpoint SmartEndpoint. I'm trying to import the SSL certificate and facing the following error: "An Error has occurred while importing the certificate. Internal Error.."

The certificate is in .pem format.

What can be potential cause for this error? How do I solve it?

If it is possible, can I get the commands to import the certificate from CLI expert mode, please?

I've also imported the CA certificate of the LDAP server. No issues with that.

*Attached Server Logs*

Thank you.

Re: Import SSL certificate to Checkpoint SmartEndpoint

Swiftyyyy — Thu, 13 Apr 2023 17:21:16 GMT

I suggest you follow the steps outlined in the Harmony Endpoint server administration guide https://sc1.checkpoint.com/documents/R81.10/SmartEndpoint_OLH/EN/Topics-EPSG-R81.10/DirectoryScanner.html?Highlight=ad%20scanner

The relevant steps will be from step 6. onward at the bottom of the article. You should use the keytool program to establish trust.
To obtain the TLS/SSL certificate from the domain controller I find it easiest to perform the following command on the EP MGMT server in Expert mode.

cpopenssl s_client -connect domain.contoller:636 | cpopenssl x509 > LDAPScert.cer

Re: Import SSL certificate to Checkpoint SmartEndpoint

chethan_m — Fri, 14 Apr 2023 10:19:16 GMT

Thank you for the guide.

I followed the same steps as there are in the document from downloading the certificate from DC and importing it to the Endpoint Security Server. But still I'm encountering the same error "SSL certificate is not installed" when I try to integrate the AD server with SmartEndpoint.

cpopenssl s_client -connect domain.contoller:636 | cpopenssl x509 > LDAPScert.cer

And the above command keeps on running without a output.

Re: Import SSL certificate to Checkpoint SmartEndpoint

Swiftyyyy — Fri, 14 Apr 2023 10:20:38 GMT

I assume you've corrected the "domain.contoller:636" to the hostname of the domain controller you're binding extracting the SSL certificate from?

Re: Import SSL certificate to Checkpoint SmartEndpoint

chethan_m — Wed, 19 Apr 2023 07:12:21 GMT

@Swiftyyyy wrote:
I assume you've corrected the "domain.contoller:636" to the hostname of the domain controller you're binding extracting the SSL certificate from?

Off course yes. I have.

Re: Import SSL certificate to Checkpoint SmartEndpoint

Swiftyyyy — Thu, 20 Apr 2023 13:54:26 GMT

Could you try without the redirect at the end? So without writing into a file.

This way you should see the raw output of the certificate being shown. Note that to finish writing the certificate into the file, you would have to press "Enter" at some point to "close" the SSL CONNECT session.

Assuming you just hang without output at this command; I'd suggest verifying your Endpoint server can even reach your directory server over port 636.

cpopenssl s_client -connect domain.controller:636 | cpopenssl x509