topic Re: Portal and vpn certificate in General Topics

Portal and vpn certificate

Ilovecheckpoint — Tue, 18 Mar 2025 10:59:07 GMT

I'm on a case where vpn certificate is valid and portal certificate has expired since a while, but mobile access on office mode, has no problem on connecting on vpn.

Checkpoint Smart Console allows update easily vpn certificate directly from gateway/cluster object.

Why does not update automatically also portal certificate as well?

Of course not everybody decide to use the same certificate, but it would be easier on case I use the same.

Why is not possible from GUI to export the vpn certificate and to import the same on portal?

Is there a way to check from a management via ssh/logs, if a portal certificate has expired or when it expires?

Re: Portal and vpn certificate

G_W_Albrecht — Tue, 18 Mar 2025 13:17:30 GMT

sk97648: How to create and configure certificate for Gaia Portal

sk108352: How to create / update the Gaia Portal certificate (signed by ICA) for Security Gateway / Cluster

sk110056: How to revert a Portal Certificate from a 3rd Party to Internal CA certificate

sk181410: Best Practices for Gaia Portal Certificate

Re: Portal and vpn certificate

Ilovecheckpoint — Fri, 25 Apr 2025 14:01:21 GMT

I manage a lot of gateways so a lot of vpn certificates and a lot of portal certificates. I have found a command on management to check vpn certificate.

What about to check from management when a portail certificate expires?

Why is not possible to see the portal certificate expiration as is seen for ipsec ?

If I export vpn certificate created via internal Checkpoint CA, via cli and reimport it on portal certificate, do user have a warning message?

Re: Portal and vpn certificate

the_rock — Fri, 25 Apr 2025 15:49:27 GMT

Im fairly sure the only time they would see the cert warning is if they delete/re-create the site.

Andy

Re: Portal and vpn certificate

the_rock — Tue, 29 Apr 2025 01:40:40 GMT

Hey mate, were you able to figure this out?

Andy

Re: Portal and vpn certificate

Duane_Toler — Tue, 29 Apr 2025 04:51:44 GMT

Clients will not get a fingerprint warning. The fingerprint is that of the CA certificate, not he gateway certificate. Renew VPN certs all you want!

Re: Portal and vpn certificate

the_rock — Tue, 29 Apr 2025 10:20:22 GMT

Thats true, every time I renew it in the lab, I never see the warning.