CheckPoint GAIA - Secure Connection Failed

[darren97]

Hello,

I'm unable to access web portal of GAIA. SSH access works fine, data plane works fine.

Only thing that was changed, I removed configuration for Identity Awareness from the cluster. It wasn't used and IA server's were down anyway. So, I removed the configuration and disabled feature in General Properties.

I tried to restart rconfd and httpd2, but it didn't help.

Do you have any idea what could be the problem?

Thank you.

[simonemantovani]

Hello

did you check if the port for Gaia portal is LISTEN? If yes, did you check logs for httpd2?

/var/log/httpd2_error_log

/var/log/httpd2_access_log

Dumb question: could you confirm if traffic to gaia portal is permitted or not?

[darren97]

Hello,

Yes, it's listening. Yes, traffic is permitted.

It looks like problem with certificate, but nobody touched anything in the terms of SSL/TLS. Only thing was disabled IA.

/var/log/httpd2_error_log:

[Wed Sep 16 16:18:44.424315 2026] [mpm_prefork:notice] [pid 10858:tid 10858] AH00169: caught SIGTERM, shutting down
[Wed Sep 16 16:18:56.301618 2026] [mime_magic:error] [pid 12331:tid 12331] (2)No such file or directory: AH01515: mod_mime_magic: can't read magic file /web/conf/magic
[Wed Sep 16 16:18:56.302124 2026] [ssl:warn] [pid 12331:tid 12331] AH01906: 10.10.10.10:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Sep 16 16:18:56.302137 2026] [ssl:warn] [pid 12331:tid 12331] AH01909: 10.10.10.10:443:0 server certificate does NOT include an ID which matches the server name
[Wed Sep 16 16:18:56.316034 2026] [so:warn] [pid 12331:tid 12331] AH01574: module setenvif_module is already loaded, skipping
[Wed Sep 16 16:18:56.316047 2026] [so:warn] [pid 12331:tid 12331] AH01574: module headers_module is already loaded, skipping
[Wed Sep 16 16:18:56.317829 2026] [core:warn] [pid 12331:tid 12331] AH00117: Ignoring deprecated use of DefaultType in line 421 of /web/conf/httpd2.conf.
AH00558: httpd2: Could not reliably determine the server's fully qualified domain name, using 10.10.10.10. Set the 'ServerName' directive globally to suppress this message
[Wed Sep 16 16:18:56.318038 2026] [mime_magic:error] [pid 12331:tid 12331] (2)No such file or directory: AH01515: mod_mime_magic: can't read magic file /web/conf/magic
[Wed Sep 16 16:18:56.318531 2026] [ssl:warn] [pid 12331:tid 12331] AH01906: 10.10.10.10:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Sep 16 16:18:56.318544 2026] [ssl:warn] [pid 12331:tid 12331] AH01909: 10.10.10.10:443:0 server certificate does NOT include an ID which matches the server name
[Wed Sep 16 16:18:56.320182 2026] [mpm_prefork:notice] [pid 12331:tid 12331] AH00163: CPWS/2.4.61 (Unix) OpenSSL/1.1.1w configured -- resuming normal operations
[Wed Sep 16 16:18:56.320214 2026] [core:notice] [pid 12331:tid 12331] AH00094: Command line: '/web/cpshared/web/Apache/2.2.0/bin/httpd2 -f /web/conf/httpd2.conf -D FOREGROUND'

/var/log/httpd2_access_log:

127.0.0.1 - - [16/Sep/2026:16:15:17 +0200] "OPTIONS * HTTP/1.0" 200 1145 "-" "CPWS/2.4.61 (Unix) OpenSSL/1.1.1w (internal dummy connection)"
127.0.0.1 - - [16/Sep/2026:16:18:57 +0200] "OPTIONS * HTTP/1.0" 200 1145 "-" "CPWS/2.4.61 (Unix) OpenSSL/1.1.1w (internal dummy connection)"

[simonemantovani]

Hello

the lines reported in error log about  certificate are warning, and I'm not so sure that this could be the reason, in any case, first of all checks which certificate is used into the Platform Portal section within the firewall object in SmartConsole.

Let me add also this SK, if you want to debug the issue: https://support.checkpoint.com/results/sk/sk84561

[Martijn]

Hi,

This is the case for both cluster members?
Did you check the Gaia port is still 443? 'show web ssl-port'

Can you perform a tcpdump to see if HTTPS traffic is coming in and there is a reply?
Any relevant logs in SmartLog.

The following article may be usefull to investigate.

sk91380 - How to troubleshoot Gaia Portal (WebUI)

Regards,
Martijn