topic Re: Avoid fingerprint warning after certificate renewal in SASE and Remote Access

Avoid fingerprint warning after certificate renewal

Cihat_Bulut — Sat, 08 Nov 2025 14:22:49 GMT

Hello,

If you don’t want VPN clients to receive warnings every time the server certificate changes, don’t import only the server certificate. Instead, include the root and intermediate certificates within the server certificate itself. You can do this using the command below.

Assume you have one SubCA:

cat SubCA.crt rootCA.crt >> fullchain.crt

cpopenssl pkcs12 -export -inkey private.key -in cert.crt -certfile fullchain.crt -name "myCert" -out mycert.p12

Import this file into the Mobile Portal. The fingerprint shown will correspond to the Root CA.

After this, you won’t see any warnings as long as the Root CA remains the same.

Re: Avoid fingerprint warning after certificate renewal

the_rock — Sat, 08 Nov 2025 18:55:07 GMT

Excellent, thank you for that @Cihat_Bulut

Re: Avoid fingerprint warning after certificate renewal

Lesley — Sat, 08 Nov 2025 20:04:32 GMT

Thanks for the tip first of all.

Only thing I would like to add if you use a fail chain will give an anchor warning in SSL labs.

Instructions

When scanning through SSL Labs, it shows "Chain issues Contains anchor"

It means that you have added Intermediate as well as Root CA, when you only need the Intermediate as the client will already have Root CA (will be already trusted by browser in browser certificate store).

It's not an issue in the sense that the anchor is not allowed, but that the extra certificate (which serves no purpose) is increasing the handshake latency.

Because of TCP slow start, the first bytes on a connection are the slowest. Hence, you can minimize the size of the handshake so that HTTP bytes can start flowing as soon as possible. So the issue is not so much "can the extra certificate fit into the initial window" (it most likely can, even with the old setting of 3 network segments), but "what other, more useful, data could we be sending instead".

Also this sk is relevant for fingerprints: https://support.checkpoint.com/results/sk/sk66263

Re: Avoid fingerprint warning after certificate renewal

the_rock — Sat, 08 Nov 2025 20:19:26 GMT

Excellent points @Lesley