topic Re: The Internal Certificate Authority (ICA) certificate will expire in General Topics

The Internal Certificate Authority (ICA) certificate will expire

dehaasm — Thu, 11 May 2023 09:09:23 GMT

Hi All we received this alert since a couple of days that the ICA cert of the SMS will expire in one year. We are using R81.10 at the moment.

Warning (The Internal Certificate Authority (ICA) certificate will expire on May 5 10:02:29 2024 GMT . To renew it, follow <a href = "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk158096">sk158096</a>)

So there seems to be a procedure to renew this cert but I am very curious on what would be the impact on the Identity awareness agent.

"The end user is still able to connect from the VPN client and/or Identity Agents by clicking “Trust and continue” / “Trust” respectively.

To avoid these warning messages in the first place, we recommend that you publish the renewed fingerprint centrally to all your VPN clients / Identity Agents right after the renewal of the Internal CA certificate.

Unfortunately, the new fingerprint is generated only when the Internal CA certificate is renewed.

Note - There is no way to push the new fingerprint before the renewal of the Internal CA certificate"

I believe the IA agents are using a different certificate which is installed on the gateway so how does that relate to the ICA cert of the SMS?

We obviously dont want to impact any end user especially the IA agent needs to be connected all the time, could anyone please leave your comments on this?

Re: The Internal Certificate Authority (ICA) certificate will expire

PhoneBoy — Thu, 11 May 2023 19:25:23 GMT

Different certificate, but it's signed by the same CA (the Internal CA).
Having said that, no previously issued certificates will be invalidated.

Not sure how this works with the Identity Agents, unfortunately.

Re: The Internal Certificate Authority (ICA) certificate will expire

dehaasm — Fri, 12 May 2023 12:14:40 GMT

I understand but we need to prevent impacting the IA agents installed on the laptops (new fingerprint popup), should I open a TAC case to investigate?

Re: The Internal Certificate Authority (ICA) certificate will expire

PhoneBoy — Fri, 12 May 2023 18:29:32 GMT

I would recommend a TAC case on this, yes.

Re: The Internal Certificate Authority (ICA) certificate will expire

dehaasm — Mon, 22 May 2023 21:15:21 GMT

NEW: Previously, the Internal CA certificate required manual renewal process. Now it will be automatically renewed one year before its expiration date.

take 95 PRJ-44576,
PMTR-90463

this fixed it automatically

Re: The Internal Certificate Authority (ICA) certificate will expire

starmen2000 — Thu, 07 Sep 2023 18:48:34 GMT

But the question is, if ICA is automatically renewed, what about VPN certificates and VPN users? Will their connection be affected after ICA auto-renew? Because I can still see the old VPN certificate in the gateway properties.

Re: The Internal Certificate Authority (ICA) certificate will expire

PhoneBoy — Thu, 07 Sep 2023 20:46:45 GMT

No, it should not.

Re: The Internal Certificate Authority (ICA) certificate will expire

JozkoMrkvicka — Fri, 08 Sep 2023 05:40:20 GMT

No impact for VPN users. However, VPN users connecting to the gateway where ICA was renewed, will be asked to confirm new fingerprint once ICA is renewed.

Re: The Internal Certificate Authority (ICA) certificate will expire

starmen2000 — Fri, 08 Sep 2023 08:06:28 GMT

What about the Site to Site VPNs, theirs autentication works over Certificate from the same SMS? After ICA changed, what are the best practise steps to make sure the tunnels are working properly?

Re: The Internal Certificate Authority (ICA) certificate will expire

dehaasm — Fri, 08 Sep 2023 08:44:36 GMT

it is automatically renewed since take 95 take a look at release notes we did it and had no impact with identity awareness nor IPsec VPNs although we don't use VPN remote access on the Check Point

NEW: Previously, the Internal CA certificate required manual renewal process. Now it will be automatically renewed one year before its expiration date.

Re: The Internal Certificate Authority (ICA) certificate will expire

JozkoMrkvicka — Fri, 08 Sep 2023 18:29:41 GMT

do nothing 🙂 there is nothing to be worried about S2S VPNs once ICA is renewed. Nothing to do in this area.

Re: The Internal Certificate Authority (ICA) certificate will expire

the_rock — Fri, 08 Sep 2023 18:31:46 GMT

As @JozkoMrkvicka said, no need to worry 🙂