topic Re: VPN Communities certificate problem in Spark Firewall (SMB)

VPN Communities certificate problem

agilberti — Mon, 10 Oct 2022 15:47:06 GMT

Hi, from last friday we have problem with vpn configured by communities.

there are problem during IKE phase with certificate

I try to disconnect gateways from console, reinitialize certificates and reconnect.

I try also to cancel community and ricreate but all attemps don't work.

The communities are configure in star or mesh VPN Type but none work.

Re: VPN Communities certificate problem

PhoneBoy — Mon, 10 Oct 2022 19:24:20 GMT

The error message is pretty clear: "main mode cannot complete certificate chain."
That points to an error with the Certificate Authority key you've imported.
If the CA key is not a root CA (i.e. it's signed by another CA key), you need to include the entire certificate chain in the .p12 file you import (meaning the public CA key you care about along with all the public CA keys required to validate that signature).

Re: VPN Communities certificate problem

agilberti — Mon, 10 Oct 2022 22:17:00 GMT

Gateways involved until friday work fine i don't make any change.

Our gateways are 600, 700 and 1500 series locally managed by Quantum Sparks SMP.

Where i find CA key? on SMP?

Re: VPN Communities certificate problem

PhoneBoy — Tue, 11 Oct 2022 18:33:08 GMT

This is for the CA key that you are using to authenticate the VPN, which I believe is configured in SMP.
If it's the internal CA you're using, then you'll probably need the TAC to assist in resolving this issue.
If it's a different CA, then you'll have to see if the gateways can (among other things) reach the CRL specified as part of the public key.

Re: VPN Communities certificate problem

Amir_Ayalon — Tue, 11 Oct 2022 22:08:54 GMT

There are a few suggested ways to handle this issue:

From the web UI: Disconnect from SMP, remove the old trusted CA, reconnect to SMP

Connect to the GW using web UI
Stop cloud services – This is needed because otherwise the old certificate is locked to SMP and cannot be deleted
Remove the old SMP trusted CA (expires in 2027)
Reconnect to cloud services
Verify the updated SMP certificate exists (expires in 2032) and VPN tunnel is working as expected

if this doesn't work, please open a TAC case, there are more advanced ways to solve it.

Thanks

Re: VPN Communities certificate problem

Chris_Atkinson — Tue, 11 Oct 2022 23:07:24 GMT

As I explained in the other thread there was an event on Oct 6 that may require you to take some action, refer:

https://status.checkpoint.com/

Re: VPN Communities certificate problem

PhoneBoy — Thu, 13 Oct 2022 19:18:35 GMT

SK about this issue: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180117