topic Re: Fingerprint different on macos and Windows in SASE and Remote Access

Fingerprint different on macos and Windows

Greifenstein — Fri, 22 Dec 2023 09:08:44 GMT

I just recognized after a certificate change, that the fingerprint shown at first connect is different between macos and Windows.

Windows correspondends with the fingerprint shown in the "VPN Clients -> SAML Portal Settings" and "Mobile Access -> Portal Settings" on the gateway in SmartConsole, but not the fingerprint shown when first connecting with macos.

Customer told, that after changing the certificate, macos clients show a different fingerprint than Windows.

Just checked it with a new connection with my Mac: same issue. Fingerprint on macos is different to Windows/SmartConsole.

why?
this is an issue, when trying to avoid the popup, when changing the certificate and therefore the fingerprint. See https://support.checkpoint.com/results/sk/sk66263

Just checked the situation with another customer:

Fingerprint stored in the Windows Registry is the same as in Portal Settings
Fingerpring stored in file "/Library/Application Support/Checkpoint/Endpoint Connect/registry/HKLM_registry.data" on macos is different than in Portal Settings

Regards
Christian

Re: Fingerprint different on macos and Windows

PhoneBoy — Fri, 22 Dec 2023 23:48:59 GMT

This is probably going to require the TAC to investigate: https://help.checkpoint.com

Re: Fingerprint different on macos and Windows

Greifenstein — Wed, 28 Feb 2024 20:55:11 GMT

The reason is written in sk662263 itself, which I read over:

Note: There is limitation for macOS Remote Access clients when using 3rd party CA with more than two certificates in a chain. On initial connect, they show only the Fingerprint of the certificate next to the Peer certificate in a chain. For example, in case of 3 certificates in a chain: CA , SubCA and Peer, the SubCA's fingerprint will be shown.

Christian