topic Re: Centrally managed Spark appliance and VPN certificates in Spark Firewall (SMB)

Centrally managed Spark appliance and VPN certificates

David_C1 — Wed, 05 Feb 2025 13:54:04 GMT

We use SmartProvisioning to manage 25 or so Spark appliances. These appliances are used as satellite gateways in a VPN community, with the center gateways managed by the same SMS. I cannot find a way to determine the age/expiration date of the VPN certificate generated by the SMS (in SmartProvisioning). Here is a screenshot of the VPN tab where the cert is generated:

As you can see, no details available. The webUI of the Spark appliance does show installed certificates, but the certs shown here are the locally generated certificates.

Is there a way to see the details of the certificate generated in SmartProvisioning, which is actually used for the VPN authentication?

Thanks,

David

Re: Centrally managed Spark appliance and VPN certificates

PhoneBoy — Thu, 06 Feb 2025 14:39:41 GMT

The local WebUI will only show you local certificates, I believe.
Might need to use cpca_client lscert from Expert Mode.

Re: Centrally managed Spark appliance and VPN certificates

David_C1 — Thu, 06 Feb 2025 15:15:01 GMT

Phoneboy - you are correct, local WebUI only shows local certificates (something not very helpful with centrally managed gateways) and the command you provided does show me what I need to see - thank you for that.

That being said, it would be nice if the certificate view in SmartProvisioning had same features as in SmartConsole, where you can actually see details of the cert.

Dave

Re: Centrally managed Spark appliance and VPN certificates

David_C1 — Thu, 06 Feb 2025 15:29:10 GMT

Bad form I know to reply to my own post, but follow up question:

cpca_client lscert shows me the certs that the CA has issued (including expired, revoked certs). There are many examples of numerous certs issued for the same gateway, same function. How do I know which cert the client is actually using? If one cert is expired, one is valid, I can assume that the gateway is using the valid cert? Or is there some way on the client side I can verify?

Dave

Re: Centrally managed Spark appliance and VPN certificates

PhoneBoy — Thu, 06 Feb 2025 15:49:24 GMT

Only valid certs should be used.
To see which one is actually used, a debug might be required.