https://community.checkpoint.com/t5/SASE-and-Remote-Access/Import-the-root-CA-and-intermediate-CAs-for-authentication-with/m-p/151882#M6540 <P>Hello everybody,</P><P>We are trying to enable MFA on the remote VPN. Authentication is currently done through LDAP and works perfectly. We want to enable authentication with digital certificate from an external CA and LDAP username and password. We made the necessary settings informing the LDAP field used to compare with the digital certificate field. We verified in the logs that the field (Subject DN.CN) is correctly extracted from the certificate. However, during client authentication, the following error message is displayed:<BR />"<STRONG>cannot complete certificate chain CN=Brazilian Root Certification Authority v5,OU=National Institute of Information Technology - ITI,O=ICP-Brasil,C=BR</STRONG>"</P><P>I would like to know where and how to import the root CA and intermediate CAs.</P> Mon, 27 Jun 2022 23:26:26 GMT efchaves 2022-06-27T23:26:26Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Import-the-root-CA-and-intermediate-CAs-for-authentication-with/m-p/151882#M6540 <P>Hello everybody,</P><P>We are trying to enable MFA on the remote VPN. Authentication is currently done through LDAP and works perfectly. We want to enable authentication with digital certificate from an external CA and LDAP username and password. We made the necessary settings informing the LDAP field used to compare with the digital certificate field. We verified in the logs that the field (Subject DN.CN) is correctly extracted from the certificate. However, during client authentication, the following error message is displayed:<BR />"<STRONG>cannot complete certificate chain CN=Brazilian Root Certification Authority v5,OU=National Institute of Information Technology - ITI,O=ICP-Brasil,C=BR</STRONG>"</P><P>I would like to know where and how to import the root CA and intermediate CAs.</P> Mon, 27 Jun 2022 23:26:26 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Import-the-root-CA-and-intermediate-CAs-for-authentication-with/m-p/151882#M6540 efchaves 2022-06-27T23:26:26Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Import-the-root-CA-and-intermediate-CAs-for-authentication-with/m-p/151943#M6541 <P>You need to create a Certificate Authority object if you haven't already.<BR />In the file you import, you will need to include the entire certificate chain (root plus intermediate ones).</P> <P>If you've done that already, it's possible you will need to import the root and intermediate certs to the clients themselves.</P> Tue, 28 Jun 2022 17:49:11 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Import-the-root-CA-and-intermediate-CAs-for-authentication-with/m-p/151943#M6541 PhoneBoy 2022-06-28T17:49:11Z