topic Re: Capsule Connect VPN Issue(The site's certificate has expired) in SASE and Remote Access

Capsule Connect VPN Issue(The site's certificate has expired)

Amber — Wed, 10 Sep 2025 12:58:04 GMT

Hi all,

I'm encountering a problem. I have a 5000 series gateway (R81.10) managed by SMS (R81.20). Last Friday, I renewed the VPN certificate for the 5000 series gateway. After renewing the certificate, both the IPsec VPN and the desktop Remote Access VPN client are working well.

However, VPN connections from mobile devices using Capsule Connect are not working. When attempting to connect via Capsule Connect, the client displays a message indicating that the site's certificate has expired.

Please suggest. Many thanks.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

the_rock — Wed, 10 Sep 2025 15:17:59 GMT

Hey Amber,

Can you have them try delete/re-create the site and test? Just have one or two random users do that.

Andy

Re: Capsule Connect VPN Issue(The site's certificate has expired)

Lesley — Wed, 10 Sep 2025 19:32:35 GMT

You sure the clients trust the new certificate?

https://support.checkpoint.com/results/sk/sk167255

Just to make sure you done policy push after cert renewal?

Re: Capsule Connect VPN Issue(The site's certificate has expired)

the_rock — Wed, 10 Sep 2025 19:35:33 GMT

Good points @Lesley

Re: Capsule Connect VPN Issue(The site's certificate has expired)

Amber — Thu, 11 Sep 2025 08:54:19 GMT

Hi Lesley,

When using Capsule Connect to establish a VPN connection, the self-signed certificate does not appear to trust. According to sk167255, the recommended solution is to add a third-party trusted certificate to the Mobile Access Blade.
May I kindly ask if it is possible to use the gateway’s self-signed certificate for Mobile Access instead?

Many thanks.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

Lesley — Thu, 11 Sep 2025 14:39:06 GMT

As user still is able not to trust a third party (not self-signed) certificate. If you import certificate without the Intermediate CA and only the certificate systems can complain about it: invalid certificate. Normally you import all Intermediate CA's including the certificate and not the root CA. You can also include root ca but that should not be needed as it is expected that all clients are known with the root ca.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

PhoneBoy — Thu, 11 Sep 2025 14:57:33 GMT

You can use the Internal CA for this, but for the error message to go away, the end user will have to manually configure the CA as trusted on their device.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

the_rock — Thu, 11 Sep 2025 15:09:50 GMT

I guess similar to ssl inspection...maybe not best comparison though.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

Amber — Fri, 26 Sep 2025 03:05:56 GMT

Many thanks to everyone for their help. I opened a technical ticket with Check Point support. They suggested using the command "#fw kill vpnd" to restart the VPN process. I tried it, and it worked. Thank you very much again.

Re: Capsule Connect VPN Issue(The site's certificate has expired)

the_rock — Fri, 26 Sep 2025 03:20:30 GMT

Great! Thanks for letting us know, appreciated.

Andy