Eval license

[velo]

In the past, many times I have deployed a management server and a gateway for testing upgrades, and different scenarios. This has always worked great, with no problems. I would get this error, but updates would still work fine on the eval.

I am trying to do the same on 82.20 to lab up upgrading to 82.xx but this time it will not allow me to download updates. 

I have tried to run 'installer check-for-updates' but I get this error:

The administrator did not authorize downloads, not performing update

I found this article, and tried what it says with the show consent flags, but no joy.

Has something changed with the way eval license works?

Thanks

[simonemantovani]

Hello

what is the output of cplic print -x ?

DAagent is already the latest version?

I know that it's not fair, but as a workround you can download the update package (Blink Image for example), and try to import on the garteway/management you want to upgrade, and manually upgrade it.

[the_rock]

Hey @velo 

If you send us the output of cplic print -x, as @simonemantovani mentioned, woiuld certainly give us a better idea.

[velo]

Hi all

Answering all the questions here. I did check internet connectivity was working as one of my initial checks. DU agent is latest version. 

Here are the outputs. 

[simonemantovani]

You don't have any license reported in cplic output, could you try to create and attache a new evaluation license (all-in-one license)?

[velo]

Is this a new requirement because I have never had to do it before. Previously the appliance would work fine for 15 days.

[simonemantovani]

Not so new, I noticed id in the last couple of years more or less (since R81.x for sure).

[velo]

I will look into this as I have never done it before. The thing is, it even says this in my screenshot as you see. 

Check Point product trial period will expire in 15 days.
Until then, you will be able to use the complete Check Point Product Suite.

[simonemantovani]

Yes I agree with you ... sometimes information in documentation may be a bit contradictory ... In any case, if you can try with an Eval license from UserCenter.

[velo]

This didn't work either, but as pointed out by @emmap there is a problem with the updater.

[PhoneBoy]

This CRL issue seems to also impact evaluation licenses on R82 and R82.10: https://support.checkpoint.com/results/sk/sk184766

[velo]

Ah yes, I saw that one. Thanks for the reminder. I'm on 81.20 in the lab. (attempting to go to 82.x)

Thanks

[Lesley]

Checked the last 3 points, DNS / routing, are you able to access checkpoint websites from the unit?

curl -vk https://updates.checkpoint.com

[rboettger]

We have two in productive Check Point environments on R81.20 and we got following issue:

[Expert@xxx:0]# curl_cli -vvvk https://updates.checkpoint.com
* Rebuilt URL to: https://updates.checkpoint.com/
* Trying 18.245.31.62...
* TCP_NODELAY set
* Connected to updates.checkpoint.com (18.245.31.62) port 443 (#0)
* ALPN, offering http/1.1
* *** Current date is: Wed Mar 11 08:08:38 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Wed Mar 11 08:08:38 2026
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* err is -1, detail is 2
* *** Current date is: Wed Mar 11 08:08:38 2026
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: CRL validation was disabled
* Server certificate:
* subject: CN=*.checkpoint.com
* start date: Jun 3 12:12:04 2025 GMT
* expire date: Jul 5 12:12:03 2026 GMT
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign GCC R3 DV TLS CA 2020
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* servercert: Finished
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< Content-Length: 15
< Connection: keep-alive
< Date: Wed, 11 Mar 2026 07:08:38 GMT
< Server: awselb/2.0
< X-Cache: Error from cloudfront
< Via: 1.1 b7c8b552077b93dc0acaa0b82d11fa62.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: FRA56-P8
< X-Amz-Cf-Id: PQ_vDANXFlWawcxX7u_5xnyqfAn9Vj7eMRvxZyJL1HAB9AY9qinhEg==
<
* Connection #0 to host updates.checkpoint.com left intact

[emmap · Accepted solution]

There is an issue with the updater, a new agent will be rolled out over the coming week to resolve it. At this stage you might just have to manually import your version upgrade, migration tools and JHF files. Or check again next week if your testing isn't urgent.

[velo]

Thanks, thought that might be the case. See below, also pointed out by another poster

[velo]

I am performing an upgrade on a Cluster tomorrow and will use CDT. Will this be a problem?

Thanks

[emmap]

It may, if the boxes in question don't have the latest DA build (2742) that is being gradually rolled out. I would also recommend making sure you have the CRL patch on the management server just in case. 

https://support.checkpoint.com/results/sk/sk92449 <- Deployment agent. We don't have a download link for the new one up there yet but maybe check before you start the upgrade. 

[velo]

Thank you