topic Re: VPN through Gateway Browsing HTTPS residual certificate issue in SASE and Remote Access

VPN through Gateway Browsing HTTPS residual certificate issue

Vladimir — Sun, 25 Mar 2018 22:05:31 GMT

With HTTPS inspection configured and Outbound Certificate distributed, following behavior being observed:

From internal hosts, browsers reaching destination, substituted certificate is shown as valid and there are no indications of the intercept:

When remote client (Endpoint VPN) establishes the connection to the same site, certificate is substituted, declared "valid", but the browser indicates the site being "Not Secure":

Certificate is installed on the remote client in Trusted Root Certification Authorities:

The culprit was the older certificate issued by the same gateway and installed on clients. After removal of the old certificate, clients' browsers behavior reverted to normal.

Re: VPN through Gateway Browsing HTTPS residual certificate issue

Gaurav_Pandya — Mon, 26 Mar 2018 11:01:02 GMT

Hi Vladimir,

Good Document.

We import either new certificate or renew the certificate if it is expired but if certificate is still valid and you import new one then you should remove the older one otherwise it points to older one.

Re: VPN through Gateway Browsing HTTPS residual certificate issue

Vladimir — Mon, 26 Mar 2018 12:47:17 GMT

Too bad there is no CRL mechanism interface in Check Point that makes it manageable.