topic Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect in SASE and Remote Access

How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Mon, 30 Dec 2024 11:57:16 GMT

Hello,

We have deployed new remote access VPN. Where we implemented vpn Client on Mobiles (Checkpoint Capsule connect) but we are getting certificate warning to Trust and Continue. So How to prevent Untrusted Certificate warning message on mobile Phone (checkpoint capsule connect)

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

AkosBakos — Mon, 30 Dec 2024 12:26:52 GMT

Hi @Prasaddere

Can you share a screenshot of the message?

My first 2 idea for solution.

Use 3rd party certificate. Choose one that its root is installed in the Trusted Root Certificate store on the device.
(eg.:DigiCert)

Install the Check Point's root and issuer certificate onto the devices.

Akos

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

the_rock — Mon, 30 Dec 2024 14:26:40 GMT

I see what Akos is saying. But, first, screenshot would certainly help. Just blur out any sensitive data, please.

Andy

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

PhoneBoy — Tue, 31 Dec 2024 01:25:45 GMT

Pretty sure you need to deploy the ICA CA certificate to the mobile device as "trusted."
This either has to be done via MDM or manually.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Tue, 31 Dec 2024 09:47:48 GMT

Attached screenshot. we have already deployed certificate from internal CA for Mobile blade portal and different certificate for IPSec Client including all root and subordinate CA. Still getting the attached message for certificate trust first time which we need to avoid.

Same we had issue on Windows laptop but we solution to add fingerprint in Windows registry. which we have added. Issue is only with now on Mobile phone.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Tue, 31 Dec 2024 09:49:56 GMT

Certificate from internal CA already added in root CA as well issuing CA. Also server certificate attahed on IPsec client. as seperate CSR generated for mobile against which we got another certificate P12 which we import on mobile portal.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

AkosBakos — Tue, 31 Dec 2024 11:05:57 GMT

Hi,

To be sure, when you accepted the cert and check the certificate chain, everything looks normal?

If you use MDM only one certificate store exists on the device?

Akos

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Tue, 07 Jan 2025 12:57:18 GMT

we have tried with the public certificate but there same trust message is coming first time when creating the site.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

the_rock — Tue, 07 Jan 2025 13:07:32 GMT

Is it same issue if user deletes/re-creates the site?

Andy

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Tue, 07 Jan 2025 13:09:52 GMT

Yes, it is the same issue.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

the_rock — Tue, 07 Jan 2025 13:29:08 GMT

Did you end up opening TAC case?

Andy

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Tue, 07 Jan 2025 13:33:43 GMT

You can say, yes, IND TAC seems do not have expertise, Our many case going month on month with resolutions only asking for logs. lot of delay in response.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

the_rock — Tue, 07 Jan 2025 13:37:45 GMT

I suppose you can always get in touch with your local SE and tell them about it or ask for it to be escalated.

Andy

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

PhoneBoy — Tue, 07 Jan 2025 19:24:18 GMT

Are you sure that:

The gateway is sending the correct certificate?
The client is actually set to trust certificates signed by the relevant CA and sub-CA(s)? Please provides screenshots from the mobile client(s) showing the same certificate(s) shown in the above as trusted.

Also what mobile device(s) are you having this issue with?

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

Prasaddere — Wed, 08 Jan 2025 10:19:24 GMT

Hello Team,

We have resolved the issue. For Certificate authetication, there was no issue as we have internal PKI certificate attached in Ipsec VPN. We had issue when creating new site in application that was giving trust message with fingerprint. For which we followed below in Mobile blade portal setting certificate.

we had to put the external certificate but digicert was giving only domain name cert so we had to combine this certificate with intermediate and root Certificate, then we created p12 cert which we uploaded Mobile blade portal setting, then trust warning message, gone. It is not asking while crating site.

Thanks all for your support.

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

the_rock — Wed, 08 Jan 2025 12:03:08 GMT

Great job, thanks for letting us know!

Re: How to prevent Untrusted Certificate warning message in checkpoint capsule connect

PhoneBoy — Wed, 08 Jan 2025 23:37:17 GMT

That's pretty much standard operating procedure for anything related to certificates.
That means your p12 file should (also) contain root and intermediate CA(s).