topic Importing certificates in Check Point gateways for authentication in General Topics

Importing certificates in Check Point gateways for authentication

Di_Junior — Fri, 13 Dec 2019 08:13:17 GMT

Hi Mates

I need a hand.

We are currently migrating one of our services (skype for business) from TMG to Check Point. I am using a logical server in order to balance the traffic to our internal servers (3 servers) where the 7 DNS records that serves this application.

The problem that we are facing is with mobile devices, currently with TMG when a mobile device tries to connects, TMG presents them our certificate issued by Digicert, and everything works fine.

Now that we are migrating to Check Point, we are facing an issue with the certificate. With Check Point, when a mobile device tries to connect, it is presented with self-signed certificate on the internal servers, and the comunication does not work.

We requested the certificate that is being used by TMG, and it is a .pfx file.

Is there any way we can achieve what is being done by TMG.

We are using R80.20.

Thanks in advance

Re: Importing certificates in Check Point gateways for authentication

PhoneBoy — Fri, 13 Dec 2019 16:53:33 GMT

Logical Server objects don't have any specific support for HTTPS.
That said, you might be able to combine this with inbound HTTPS Inspection where you can configure it to present the Digicert certificate.
The gateway will need to be configured to trust the CA (or self-signed cert) for the Internal servers.

Re: Importing certificates in Check Point gateways for authentication

Di_Junior — Sun, 15 Dec 2019 06:44:07 GMT

Hi PhoneBoy

Thanks for the feedback.

"That said, you might be able to combine this with inbound HTTPS Inspection where you can configure it to present the Digicert certificate."

The Digicert certificate is in pfx format, I tried to import it in https inspections but it seems that this pfx is not supported. How can solve this issue?

Thanks in advance

Re: Importing certificates in Check Point gateways for authentication

PhoneBoy — Mon, 16 Dec 2019 02:04:13 GMT

You just need to convert the certificate using OpenSSL or some other tool.
A couple suggestions here: https://stackoverflow.com/questions/6819079/convert-pfx-format-to-p12

Re: Importing certificates in Check Point gateways for authentication

Di_Junior — Mon, 16 Dec 2019 22:55:24 GMT

Hi PhoneBoy

I have successfully convertes the certificate into p12.

How do I now present the certificates to clientes when they are trying to connect?

How do I make the gateway to trust this certificate?

You help is much appreciated.

Thanks in advance

Re: Importing certificates in Check Point gateways for authentication

PhoneBoy — Mon, 16 Dec 2019 23:47:40 GMT

You configure Inbound HTTPS Inspection as described in the documentation: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_NextGenSecurityGateway_Guide/html_frameset.htm
The certificate you have to configure the gateway to "trust" in this case is the internal CA (or self-signed) certificate(s) the gateway will see when it opens the HTTPS connection to the internal hosts.
This process should also be described in the documentation referenced above.

Like I originally said, this might work.
I don't know for sure it will.

Re: Importing certificates in Check Point gateways for authentication

Di_Junior — Wed, 08 Jan 2020 10:41:29 GMT

Hi @PhoneBoy

Thanks for your help.
I tried that, and it did not work. I am still getting the self-signed certificate instead of the Digicert certificate.
I have opened a TAC case and still waiting on their feedback.

Meanwhile, Has anyone ever implemented skype for business over a Check Point firewall and got it working? how was it implemented? because this is the only service preventing us from migrating all our services to Check Point.

Thanks in advance

Re: Importing certificates in Check Point gateways for authentication

PhoneBoy — Wed, 08 Jan 2020 23:26:58 GMT

You should start a separate thread about Skype for Business derailing the configuration and specific issues you’re running into.
I do know you probably need to bypass HTTPS Inspection for those servers.

Re: Importing certificates in Check Point gateways for authentication

Di_Junior — Thu, 09 Jan 2020 12:56:16 GMT

Hi @PhoneBoy

Thanks. I will open another thread.
Regards