topic Re: How to create CSR for the Security Gateway VPN access in SASE and Remote Access

How to create CSR for the Security Gateway VPN access

VarunTP — Tue, 02 Jul 2024 14:39:03 GMT

We have External firewall Security Gateway with 3 firewalls , and my vpn certificate is getting expire and I have to generate CSR.

Can anyone help to generate SSL for this security gateway ? Whether I need to generate from CLI or smartconsole ? since 3 firewalls are in SG .

Re: How to create CSR for the Security Gateway VPN access

PhoneBoy — Wed, 03 Jul 2024 21:06:15 GMT

This is generally done in the gateway (cluster) object.
If you specify an external CA, I believe it should offer to generate a CSR.

Re: How to create CSR for the Security Gateway VPN access

the_rock — Wed, 03 Jul 2024 22:47:46 GMT

What Phoneboy gave is totally valid, but just wondering, when you say vpn cert is getting expired, you can simply highlight it, hit renew and thats it. It will be valid for another year, unless you do below on mgmt server and then renew the cert, it would be good for 3 years.

Andy

https://support.checkpoint.com/results/sk/sk176527

Re: How to create CSR for the Security Gateway VPN access

VarunTP — Thu, 04 Jul 2024 07:59:26 GMT

Thanks for the response , I tried this but getting error "The direct CA certificate in the received chain doesn't match the CA certificate ".

I checked this but couldnt resolve . This is also mention the same error
How to fix "The direct CA certificate in the received chain doesn't match the CA certificate for which you created the certificate request." (checkpoint.com)

lemme check , thanks

Re: How to create CSR for the Security Gateway VPN access

VarunTP — Thu, 04 Jul 2024 08:00:02 GMT

Renew option wasnt coming for this particular certificate , might be we have signed with Thirdpart CA

Re: How to create CSR for the Security Gateway VPN access

PhoneBoy — Mon, 08 Jul 2024 14:01:24 GMT

Have you successfully imported each CA in the chain as suggested by the SK?
If so and you're still having issues, I suggest a TAC case: https://help.checkpoint.com

Re: How to create CSR for the Security Gateway VPN access

VarunTP — Mon, 08 Jul 2024 14:26:45 GMT

yes its worked, Thanks for the help

Re: How to create CSR for the Security Gateway VPN access

John_Tomasetti — Mon, 08 Jul 2024 15:45:10 GMT

In general, just follow the steps in sk69660. You can adjust the key length using the command line - if key length is a concern. This sk has worked for me for 10+ years.

Re: How to create CSR for the Security Gateway VPN access

VarunTP — Tue, 09 Jul 2024 07:56:10 GMT

Thanks , I have done through Smart console but end up with below issue .
How to fix "The direct CA certificate in the received chain doesn't match the CA certificate for which you created the certificate request." (checkpoint.com)
Anyway issue resolved