topic Reinitialize the Expired VPN Certificate in Spark Firewall (SMB)

Reinitialize the Expired VPN Certificate

Soroosh — Fri, 14 Feb 2025 09:31:35 GMT

Hi everyone,

Recently I have a problem with reinitializing the VPN Certificate on SMB Gateways. on a cloud managed (infinity portal) SMBs 1570, 1535, 1530, and so on with firmware R81.10.10 (996002945), and R81.10.15 (996003913) the VPN certificate is expired, and as it is connected to the SMP, I cannot reinitialize the internal certificate correctly. every time I tried, I got this error: "Failed to reinitialize certificates".
The new certificate is there, but it is not healthy, and the VPN is not working.
A Professional once told me that certificates on Cload-managed SMBs have to be managed only through SMP. I have done that, and the certificate is on the gateway, but not as a VPN certificate, as a cloud service provider certificate. At this point, the only way I can renew the certificate correctly is to disconnect the gateway from the SMP, renew the certificate, and reconnect it. But this shouldn't be the right way! Its not a solution, its just a workaround!
Has anyone any solution?
Thanks in advance.

Re: Reinitialize the Expired VPN Certificate

the_rock — Fri, 14 Feb 2025 14:51:32 GMT

That seems like a pretty serious issue. I would call TAC and get remote session going to fix it.

Andy

Re: Reinitialize the Expired VPN Certificate

PhoneBoy — Fri, 14 Feb 2025 20:14:01 GMT

TAC case is probably best here: https://help.checkpoint.com

Re: Reinitialize the Expired VPN Certificate

Ted_Serreyn — Mon, 17 Feb 2025 16:42:25 GMT

I have a long standing TAC case open on VPN certificate problems on the SMBs. It's really odd that we are still seeing issues with certificates on these (or any) devices.

In my case installing a .p12 certificate bundle for vpn.domain.com on the device, and renewing it had problems. It can be re-done (remove everything, reboot box, and re-install) but this really should NOT be required IMHO.

Of course then when the certificate is actually installed and functioning, the VPN sometimes suddenly fails to see it and stops using the certificate for VPNs causing them to fail.

I have had this issue on newer firmware R81.10.10, R81.10.15, and has finally reached a threshold of 30% failures with one of my clients.

Re: Reinitialize the Expired VPN Certificate

G_W_Albrecht — Tue, 25 Feb 2025 10:56:14 GMT

https://support.checkpoint.com/results/sk/sk180117

Re: Reinitialize the Expired VPN Certificate

Ted_Serreyn — Tue, 25 Feb 2025 15:20:49 GMT

I am aware o this SK, and it is not applicable in my case as this SK was already resolved in my environment.

Re: Reinitialize the Expired VPN Certificate

G_W_Albrecht — Wed, 26 Feb 2025 08:42:12 GMT

Our customers issue was resolved by the following procedure:

- In Expert mode, run:
pt internalCertificate

- Look for the Cloud Services certificate (it should have a hashed name, e.g., 34a823sda183f1g4h16.crt).

- Note the ID number associated with it.

- Remove the certificate from the database:
sqlcmd “delete from internalCertificate where id=xxxx” (Replace xxxx with the actual ID number.)

- Reinitialize certificates

Re: Reinitialize the Expired VPN Certificate

G_W_Albrecht — Mon, 03 Mar 2025 08:53:33 GMT

We have a final statement from CP TAC:

We reviewed the internal VPN Advanced settings configuration and noticed that all gateways were set to use the last installed certificate for VPN connections.

Since the Cloud certificate renews itself automatically, it will always be selected, ensuring that remote access continues to work even if the VPN certificate has expired.

It's important to note that if you have already reinitialized the certificates, the VPN certificate will take priority.
Since you encountered an error during this process, it may have impacted the certificate installation, making the VPN certificate the latest installed one. This could potentially affect remote access connections.

Given this, we strongly recommend leaving the VPN certificate expired if your gateways are connected to SMP.

However, if you experience any VPN issues where the VPN certificate has expired and the SMP portal certificate is the last installed certificate, please let CP TAC know, and we will investigate further.

At this time, it appears that everything is functioning as expected.