topic Re: Remote Access VPN Certificate in SASE and Remote Access

Remote Access VPN Certificate

Mike_Jensen — Tue, 12 Feb 2019 20:45:00 GMT

I have a Check Point cluster that has remote access turned on for remote access VPN use. The certificate that secure remote access is using has been found to be using a weak hashing algorithm and/or a RSA key less than 2048 bits.

I am in need of correcting this and have not been able to find a way to make remote access use a different certificate without possibly breaking SIC or my point to point VPN connections.

When I go into the gateway cluster properties > VPN Clients - I see that "defaultCert" is selected but have not been successful in finding a way to add a new and more secure certificate.

I see there are options in Global Properties from the file / launch menu but am hesitant to change anything in there.

Can anyone assist? Thank you.

Re: Remote Access VPN Certificate

Rafal_N — Wed, 13 Feb 2019 12:03:58 GMT

Hello,

Try to add it on IPSec VPN tab. Then you should be able change it for VPN Clients.

Re: Remote Access VPN Certificate

Mike_Jensen — Wed, 13 Feb 2019 13:50:45 GMT

Hello,

In the IPSEC options in Gateway Cluster Properties I click on "Add" > enter a certificate name > click " Generate" > and then I receive an error stating "Cannot generate certificate from "internal_ca" Certificate Authority because MY_CLUSTER_NAME already has a certificate generated by "internal_ca" Certificate Authority.

Re: Remote Access VPN Certificate

Jerry — Wed, 13 Feb 2019 14:33:45 GMT

all you need really is a p12/capi certificate which can be generated from users group under SmartConsole.

that's all.

Re: Remote Access VPN Certificate

Mike_Jensen — Wed, 13 Feb 2019 14:46:27 GMT

Hi Jerry,

I don't know what a p12/capi certificate is. The certificate I am trying to replace is the server certificate, not the user or laptop certificates(s).

Re: Remote Access VPN Certificate

PhoneBoy — Thu, 14 Feb 2019 03:11:26 GMT

The local VPN certificate is actually signed by the Internal CA.

Assuming the remote end is configured to trust certificates signed by the ICA, then replacing the certificate should only involve minimal disruption.

However, the existing VPN certificate must be revoked first.

Re: Remote Access VPN Certificate

Mike_Jensen — Thu, 14 Feb 2019 16:07:44 GMT

Hi Dameon,

What you are describing is exactly what I need to do, I just don't know how to to do it and can't find instructions. I am also cautious as I don't want to inadvertently revoke a cert that is used for SIC.

Are you able to point me in the right direction or coach me on how to revoke this VPN cert and generate a new one?

Thank you!

Re: Remote Access VPN Certificate

PhoneBoy — Thu, 14 Feb 2019 21:20:47 GMT

Yeah, I'm having a little trouble figuring that one out as well

What happens if you merely "renew" the certificate?

This should generate you a new certificate and you can review the number of bits to ensure it's correct.

I believe this will require a policy installation to take effect.

Otherwise, I suggest consulting with the TAC.

How To Open a Case with TAC and/or Account Services‌

Re: Remote Access VPN Certificate

lbcadenco10 — Mon, 20 Jul 2020 20:21:11 GMT

In case anyone comes across this post, here is the SK to increase the key size and renew the VPN cert

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111492&partition=Advanced&product=IPSec

Re: Remote Access VPN Certificate

Jeff_Gao — Tue, 04 Aug 2020 14:12:02 GMT

Dear
I have completed all certificate-base remote access vpn,but it prompt below：

"Connection Failed:User Email=jeff.gao@example.com,CN=Jeff.gao,OU=IT,DC=example,DC=cn unknow"

I can not search the example from sk or google

GW:R80.30 and take 214

CA：windows server 2019 and together with AD

client:Non-join-AD and trust CA root cert

Re: Remote Access VPN Certificate

VascoNunes — Tue, 26 Mar 2024 15:46:10 GMT

Have you found out the solution? I am having the same issue .-.

Re: Remote Access VPN Certificate

Prasaddere — Wed, 11 Dec 2024 11:37:20 GMT

We are having the same issue, did you get the solution for the certificate base authetication.