topic Re: Uploading External Certificate on Checkpoint Gateway in General Topics

Uploading External Certificate on Checkpoint Gateway

LostBoY — Mon, 08 Jul 2024 16:39:08 GMT

we recently had to replace all the self signed certs from out devices. I received a cert, root cert and key from DIGICERT.

from openssl i combined cert and key into a .p12 file and imported in FW. However as i didnt include root in their the cert validation is failing in subsequent scans.

Can i combine root ,cert and key files to create a .p12 ? will this solve the issue as it will have the entire chain then.

Re: Uploading External Certificate on Checkpoint Gateway

the_rock — Mon, 08 Jul 2024 16:49:42 GMT

Sounds like that can work.

Re: Uploading External Certificate on Checkpoint Gateway

PhoneBoy — Mon, 08 Jul 2024 20:14:15 GMT

Yes, you need to include all the intermediary CAs in the .p12 file.

Re: Uploading External Certificate on Checkpoint Gateway

LostBoY — Tue, 09 Jul 2024 14:49:30 GMT

Thanks for the reply..so i need to create a notepad file and copy the cert and root content in there ..save it as .crt and then create .p12 with the new .crt and key file ? do i need to copy named cert and root cert in a particular order in the .crt file ?

Re: Uploading External Certificate on Checkpoint Gateway

PhoneBoy — Tue, 09 Jul 2024 17:52:48 GMT

I usually do it from the top-level CA down.

Re: Uploading External Certificate on Checkpoint Gateway

LostBoY — Wed, 10 Jul 2024 12:54:00 GMT

okk..i went with named cert to chain and i think it worked as i was able to convert it to .012 and import it on the gateways

Re: Uploading External Certificate on Checkpoint Gateway

JP_Rex — Wed, 10 Jul 2024 13:15:15 GMT

The tool I like most for Cert Manupulation XCA
X - Certificate and Key management (hohnstaedt.de)

It is way easier then using the build in tools.

And as long as CP is keeping up do Date with the latest security patches for openSSL and Java everything is fine.

Regards

Peter

P.S.: Sometimes they don't and you have to use the cpopenssl