topic Re: Disabling CRL checking for centrally managed VPNs in Spark Firewall (SMB)

Disabling CRL checking for centrally managed VPNs

Irek_Romaniuk — Tue, 01 Aug 2017 13:10:30 GMT

I have many 1100/1400 smart provisioned, centrally managed appliances which do CRL check with management server (fw1_ica_services port) and if check fails tunnel is dropped with default of 24h. Is there a way to disable this check i.e. sk21156 ? I don't need CRL check because if I don't want appliance to have tunnel up I will terminate the provisioned object on mgmt server. Please advice

Re: Disabling CRL checking for centrally managed VPNs

PhoneBoy — Wed, 02 Aug 2017 03:24:20 GMT

I don't see why you couldn't apply the SK you referenced to solve the issue, even if you're using SmartProvisioning.

Re: Disabling CRL checking for centrally managed VPNs

Irek_Romaniuk — Thu, 03 Aug 2017 11:56:07 GMT

Correct. It's not really an issue, CRL check is default (by design) but I think it creates Denial of Service risk because the port has to be opened on public IP.

Re: Disabling CRL checking for centrally managed VPNs

Mike922 — Wed, 23 Feb 2022 19:31:03 GMT

Thanks, killing the CRL check solved my problem. My management server is nat'd behind a firewall on a large private secondary network. Support was sending me down the path of disabling all of my implied rules. That was not going to happen.

Re: Disabling CRL checking for centrally managed VPNs

stat4299 — Sat, 23 Sep 2023 02:29:36 GMT

Is anyone aware of an emergency procedure to disable this check on the gateways only? Say the primary and secondary management is down (assuming there is even a secondary). It would be great to have a way to disable the check on the gateway itself without deploying policy. This would allow the use of CRL check but just in case of that 1 big disaster that takes out management and it isn't recovered in 24 hours, you can keep your other gateways communicating through their managed VPN (certificates only work for that).

Re: Disabling CRL checking for centrally managed VPNs

_Val_ — Mon, 25 Sep 2023 06:49:55 GMT

You can disable CRL verification for VPNs on the management side, but I do not think there is a way to do that on the GW side, let alone on SBM appliances.

Re: Disabling CRL checking for centrally managed VPNs

Timothy_Hall — Tue, 10 Oct 2023 17:34:27 GMT

I think the following will work on the gateway, see here

cpprod_util CPPROD_SetValue "CPshared//6.0//reserved//libCurl" crl_disable 1 1 1

Re: Disabling CRL checking for centrally managed VPNs

patones1 — Sat, 06 Dec 2025 13:17:07 GMT

Hello Timothy

I used the command you shared in order to disabling CRL checking with success.
The CRL checking was preventing to work a VPN tunnel between to Check Point CAs (SMSs). The link to the issue bellow:

https://community.checkpoint.com/t5/Security-Gateways/R82-Site-to-site-VPN-authentication-issue-when-using/m-p/262264/thread-id/51492#M52035

Thanks for your help

Miguel