topic Certificate renew in Spark Firewall (SMB)

Certificate renew

Moudar — Sun, 30 Jun 2024 17:31:36 GMT

I got a central office with 6500 appliance cluster and branch office with 1575 SMB.

On central office I got this alert:

Warning (The VPN Certificate "CN=fwcl VPN Certificate,O=sacheck01.kis.local.p33pae" will expire on Wed Aug 28 12:54:06 2024. To renew it, follow <a href = "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk178304">sk178304</a>)

The question:

If I renew the certificate at the central office, will it affect the branch office? Do I need to renew branch office at the same time?

The branch office certificate expires in one year, while the central office certificate expires in one month.

Re: Certificate renew

the_rock — Sun, 30 Jun 2024 18:43:51 GMT

No need bro, just renew central, push policy.

Andy

Re: Certificate renew

genisis__ — Sun, 30 Jun 2024 20:45:30 GMT

Long as all the satellites and central gateways are managed from the same SMS then it would not matter as certificates are used for authentication.
What you may also want to consider is to ensure the certificate is renewed for a longer period of time (sk170558).

Re: Certificate renew

the_rock — Mon, 01 Jul 2024 02:38:45 GMT

One thing to keep in mind is that 3 years is now longest period possible and you have to renew vpn cert to reflect that once you extend it on mgmt server. Theres an sk with command for it, but hates me now to search for it on my iphone lol

Andy

Re: Certificate renew

the_rock — Mon, 01 Jul 2024 02:43:51 GMT

Nm, here it is 🙂

https://support.checkpoint.com/results/sk/sk176527

Re: Certificate renew

Moudar — Mon, 01 Jul 2024 07:05:10 GMT

Do I need to perform this procedure during a maintenance window because an outage of VPN tunnels may occur?

Re: Certificate renew

the_rock — Mon, 01 Jul 2024 11:44:59 GMT

You can do it any time, but to be safe, better outside normal hours.