Certificate and CRL validation fails from March 1, 2026

[simonemantovani]

Hello

accidentally, for the firewall infrastructure of a customer we ran into the issue reported in following SK:

https://support.checkpoint.com/results/sk/sk184766#

For the specific customer we planned to install the suggested hotfix.

Hope it could be useful.

[Steffen_Appel]

We ran into this bug too, the hotfix worked for us. It seems (by the workaround in the SK), that CP added an extra day (incorrect leap year) into the calculation.

[Mattias_Jansson]

Does the hotfix require a reboot?

[AndrzejAdamczyk]

Quite important information - does anybody can reply?

[_Val_]

Hotfix yes, workaround - no

[_Val_]

Please follow the Sk instruction. There is a workaround that can be applied right away.

Also, it is important to say that the issue mentioned in the SK is limited and may only happen with R82 and R82.10 versions.

[Steffen_Appel]

Limited to specific versions yes, limited in the effect no. We had several hundred of remote workers, who could not connect.

[_Val_]

@Steffen_Appel I think you misread my comment.

Just to be clear, "limited" means it does not happen to every GW or a user. S2S VPN tunners are affected only if X509 certs are in use. Users are affected only if cert-based auth is used. An additional limitation is about new certificates or newly generated CRLs.

That said, yes, if you are affected, it can be painful.

I want to assure you and everybody else that we are working on fixing the issue as soon as possible. The workaround mentioned in the SK is also very effective and does not require an HF installation, to buy you time for HF installation.

Please do not hesitate to reach out to TAC if you need any additional assistance.

[Steffen_Appel]

As I wrote we installed the HF and it fixes the issue for us. 

[_Val_]

Happy to hear that

[Steffen_Appel]

The HF for the 3900 cannot be installed on a freshly installed GW with take 464.

"

Verification results

1 Errors | Installation is not allowed

Verification errors:

1. Installed hotfixes are missing from this package."

[PeterKj]

I have the same issue on 3900. Just created a ticket with TAC.

[PatrickHen]

Any update from TAC yet?
Same issue on 3920 which was upgraded from previous build to T464 and seems up-to-date

[RemoteUser]

TAC answer: i'm really upset to hear that.. 

If you are using a 3900 appliance with R82.10 GA2 that was upgraded from GA1, the hotfix may not be installed.

To resolve this issue, please perform a clean installation directly to GA2. You can find the procedure in the documentation below:

sk183506 - Check Point Quantum R82.10 Release
Check Point R82.10 Gaia Clean Install and Upgrade for 3900 appliances - CPUSE offline package

After the clean installation, install GA2 and then apply the fix from SK184766.

[PatrickHen]

My TAC engineer was not aware of the above, so thank you.

I still hope TAC will come up with a working hotfix for 3900 appliances which were upgraded from GA1 to GA2.
They still seem to work ok for now and we don't wat to have to do a clean install on all of them...

[PatrickHen]

Got the same reply from TAC now.
Told him I think Check Point should be able to come up with a similar working hotfix for devices that were upgraded from GA1 to GA2 without us having to perform a clean install.
Waiting for TAC now.
(if someone from TAC is following this threat: please provide better support for customers that upgraded from GA1 to GA2 like Check Point recommended in it's mail from 13-01-2026 16:36)

[RemoteUser]

Update from TAC:

Hello Team,

I hope this email finds you well.

Based on our discussion with the R&D team, they are working on a fix that can be installed directly on the appliance, without needing the fresh install I mentioned earlier.

I can't provide an exact ETA, but it is a top priority, and we aim to deliver it as soon as possible, hopefully by the end of the day.

If you prefer not to do a fresh install, you can continue using the WA until we release the new fix.

If you prefer to use the Fresh Install step ,you can review the following SK that explains the backup steps - sk102234 - Backing up Gaia system level configuration

Thank you for your cooperation and understanding.

[Steffen_Appel]

There is a new build on top of HF22 (doesn't say anything about 22 and GA2): https://support.checkpoint.com/results/download/142063

I could not import it on JHF22 with GA2 installed.

[PatrickHen]

When you now look at the TAR for 3900 appliances under 'R82.10 GA Take 464', you see this is a new take.
Was Take 2 yesterday, is Take 9 today.
Just imported it on a 3920 which was upgraded from GA1 to GA2 and the verification is ok now :-).

[BAlexiev]

Val, after the hotfix has been installed on R82 JHF Take 44 (or earlier for that matter), when installing JHF T60, the hotfix will have to be applied again, correct?

Btw, with the hotfix installed, JHF Take 60 is no longer shown as recommended in SmartConsole on R82. It is still listed as recommended in the Gaia portal.

Thanks!

[Steffen_Appel]

Yes it is not shown as it does not include the HF, so I guess you have to uninstall the HF, install take 60 and then the T60 HF.

[Robert_Yohn]

Does the HF install on MDS require a reboot?

[Bob_Zimmerman]

Yes, installing the hotfix on an MDS requires rebooting the MDS.

[HeikoAnkenbrand]

February 29 is a leap day that occurs only every four years in the Gregorian calendar to compensate for the difference between the calendar year and the solar year.

The year 2026 is not a leap year; the next February 29 will be in 2028.

If you take a closer look at the firewall code in R82, you will see that there is a small programming error. As a result, the certificates were no longer valid from March 1 onwards 😉

[Steffen_Appel]

That was my thought is morning (see above) 🙂

[Alex_Lewis]

In my case, after installing the hotfix Gaia Software Updates can no longer access the Check Point Download Center. 

Cannot establish connection with the Check Point cloud. Connection Error, FDT - Unexpected error code. Make sure that 1. Proxy, DNS and routing are configured properly. 2. Firewall does not block traffic originating from this machine to Check Point servers (checkpoint.com and akamaitechnologies.com over HTTP and HTTPS).

[Steffen_Appel]

@Alex_Lewis I can confirm the issue.

[hvf3000]

@Alex_Lewis I am experiencing the same issue across multiple installations.

[Alejandro_Lansa]

I can also confirm this issue. I have the same problem on the 3 Gateways where I have installed the Hotfix. I have one gateway pending to be updated that still works fine.

[JBhelm]

I have the same issue, i updated management and standby node for now, and both get this error.

The non-updated Active node does not get this error.