topic Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android. in SASE and Remote Access

Check Point gateway sends an expired (and deleted) certificate to Android.

Igor_Narkevich — Thu, 05 Dec 2024 08:36:30 GMT

Hi everyone.

R81.20 take 65 with standalone Nanagement server.

Endpoint Security VPN (desktops/laptops, Windows & MacOS)
Capsule VPN (phones/tabs, Android)

Everything worked until I renewed the IPsec VPN certificate.
Desktops continued working with the new certificate (this can be seen in the log),
but there is a problem with Android.
Check Point gateway sends an expired certificate to Android (visible by fingerprint).

The expired certificate has been deleted on the Nanagement server.

Where does it get it?
And how can I fix this?

Re: Check Point gateway sends an expired (and deleted) certificate to Android.

_Val_ — Thu, 05 Dec 2024 08:41:44 GMT

I assume your phones are using Capsule.

First, double-check that you updated the Mobile Access certificate, not just the VPN certificate on the affected GW. Afterwards, reinstall policy.

If the issue still remains, open a TAC ticket.

Re: Check Point gateway sends an expired (and deleted) certificate to Android.

Igor_Narkevich — Thu, 05 Dec 2024 09:03:08 GMT

double-check that you updated the Mobile Access certificate

I do not know how to do that 😞

Only here

Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android.

CheckMatesAI — Thu, 05 Dec 2024 22:06:12 GMT

This answer is provided by Infinity AI Copilot and should be confirmed by reviewing official documentation in Support Center.

To update the Mobile Access certificate on your Check Point gateway, follow these steps:

Log in to SmartConsole:
- Open the SmartConsole application.
Access Gateways & Servers:
- From the left Navigation Toolbar, click on "Gateways & Servers".
Open Security Gateway Properties:
- Select the relevant Security Gateway object.
- Navigate to the "Mobile Access" section.
Portal Settings:
- Go to "Portal Settings" under the Mobile Access section.
Import or Replace Certificate:
- In the Certificate section, click on "Import" or "Replace".
- Choose the new certificate file you wish to use.
Install Access Control Policy:
- After importing the certificate, install the Access Control Policy on the Security Gateway to apply the changes.

For more detailed guidance, you can refer to the Mobile Access R82 Administration Guide.

If you encounter any issues or need further assistance, feel free to ask!

Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android.

Igor_Narkevich — Fri, 06 Dec 2024 04:36:37 GMT

This portal uses an auto-generated certificate.
I renewed the auto-generated certificate.
But GW continues to give out the old (expired and deleted) certificate
and only for mobile devices.

Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android.

PhoneBoy — Fri, 06 Dec 2024 14:03:23 GMT

I assume you've installed policy since making these changes?
It might also be worth doing a cprestart on the gateway (requires downtime) to see if that resolves the issue.
Otherwise, I suggest involving TAC.

Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android.

Supporto_Checkp — Thu, 28 Aug 2025 12:50:02 GMT

Same issue - Have you resolved ? How?

Re: Re: Check Point gateway sends an expired (and deleted) certificate to Android.

_Val_ — Fri, 29 Aug 2025 07:28:33 GMT

Please open a separate thread for this; this one is from 2024.

You need to restart GW to get a new certificate fetched.