topic Re: Cant renew expiring certificate in SASE and Remote Access

Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 11:44:54 GMT

Hi,

My VPN certificate on R81.20 Gateway expires soon and I went through the usual process of deleting the existing and creating a new one, however today I got hit with this message

I have not seen this before and cant find anyway round it. Found a similar post about using GuiDBedit, but that didnt work.

Any help greatly appreciated

Happy New Year

Wayne

Re: Cant renew expiring certificate

Lesley — Thu, 02 Jan 2025 12:24:24 GMT

I never delete and always use renew, have you tried that?

So instead of delete either add or renew?

You try it now to renew it under IPSec VPN correct?

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 12:26:59 GMT

Hi Lesley,

The renew option has never been available for certs generated by external CA (i assumed this was the case)

I cannot renew and if i try ADD i cant use the same CN details

Cheers

Wayne

Re: Cant renew expiring certificate

Lesley — Thu, 02 Jan 2025 12:30:13 GMT

Ah not self-signed.

What if you create a temp self signed cert and attach that, after that try to remove the old one.

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 12:32:33 GMT

Hi @Wayne_Hammond

Can you share a little bit larger screenshot? In which menu did you get this message?

Whan you changed this cert last time, this cert was used in clientless VPN too?

Akos

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 12:41:12 GMT

Still no go

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 12:42:26 GMT

Hi Akos,

My larger images seem to get removed. I always do this under IPSecVPN and have never configured Clientless VPN

Cheers

Wayne

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 12:46:55 GMT

To clarify this, so here:

You add the new one, then can't remove the old one?

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 12:48:34 GMT

Correct, at the moment I have a cert installed from an EXT CA

When i try to remove (as renew greyed out), the error message appears

I have never seen this before

Thanks

Re: Cant renew expiring certificate

Lesley — Thu, 02 Jan 2025 12:49:58 GMT

Make sure that if you have the temp cert active the old one is not configured in a different place.

Did you checked all the menu options in the firewall object itself? Like under VPN clients.

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 12:55:05 GMT

Hi Lesley,

Yes, i cannot see it selected anywhere else

Re: Cant renew expiring certificate

Lesley — Thu, 02 Jan 2025 13:04:57 GMT

I think we need some screenshots. Sometimes a feature is disabled and you need to enable it in order for renewal.

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 13:10:38 GMT

I had a try, I wanted to delete the cert which was issued by ICA

I got this error:

Maybe helps.

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 13:16:30 GMT

We haven't talk about the version. What is current version?

I found this sk, but it is not relevant, R80.20 is not supported, and the error message is totally different.

https://support.checkpoint.com/results/sk/sk108064

Akos

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 13:23:00 GMT

Saw that, but it did nothing

Thanks

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 13:26:42 GMT

Maybe it is time to open a TAC case.

Re: Cant renew expiring certificate

Wayne_Hammond — Thu, 02 Jan 2025 13:28:35 GMT

Yes time for TAC

Re: Cant renew expiring certificate

AkosBakos — Thu, 02 Jan 2025 13:30:42 GMT

Please keep us updated. 🙂

Re: Cant renew expiring certificate

the_rock — Thu, 02 Jan 2025 20:40:08 GMT

I believe what its telling you to do is remove any references of that certificate currently, install policy and then delete option would work.

Andy

Re: Cant renew expiring certificate

the_rock — Thu, 02 Jan 2025 20:43:32 GMT

Weird, just tried in my lab and though its part of 3 commuities, does not give that error.

Andy