HTTPS Ispection - Certificate Validation Failure

[Ale_G]

Hello all,

for the past few days (especially on government websites) we have been experiencing problems with web browsing. The error shown in the logs is the following:"

Certificate chain is inconsistent. Refer to sk159872 for more details.
Certificate DN: 'CN=*.fondimpresa.it,O=FONDIMPRESA,ST=Roma,C=IT' Requested Server Name: pf.fondimpresa.it.

Unhandled critical extension. Refer to sk159872 for more details.
Certificate DN: 'CN=domiciliodigitale.gov.it,O=Agenzia per l'Italia Digitale,L=Roma,ST=Roma,C=IT' Requested Server Name: domiciliodigitale.gov.it.

HTTPS isp option:

Public root certificates are present.

Can someone help me understand the reason and help me resolve the issue?

Many thanks,

Alessandro

[the_rock]

Hey Alessandro,

Did you try bypassing any of those sites as a test?

[Ale_G]

Yes, I tried to bypass HTTPS inspection and everything works.

[CaseyB]

Have you installed the CRL fix released this week? sk184766 

[emmap]

Yes do this first, it's what resolved the issue for me.

[Ale_G]

Only now I’ve noticed that a popup appeared in SmartConsole mentioning a CRL validation issue.

I’ll try updating the system and will give you feedback.

Thank you

[Ale_G]

I tried installing the fix, but it seems the problem hasn’t been resolved.

[emmap]

Did you install it on both management and gateways?

[Ale_G]

No, I've installed the fix only on the management server. Our gateways are running version R81.20, and there is no fix available for these appliances in the KB.

[emmap]

Hmm, ok, in my case it's R82 gateways and R82.10 SMS. 

Try running 'cpca_client recreate_crls' on the management server. When I did this I didn't have any interruption to anything so it seems to be safe.

[Lesley]

This website uses incomplete cert chain, see SSL labs results:

https://www.ssllabs.com/ssltest/analyze.html?d=pf.fondimpresa.it&hideResults=on

You need to add the missing inter certs in your server config. So add full chain all but not the root cert! Then you get anchor issues in ssllabs.

If you do not manage this website try to add the missing certs into the cp same as you update the CA list. 

https://support.checkpoint.com/results/sk/sk64521

[Ale_G]

Before doing that, I will install the CRL fix released this week, as suggested by @the_rock.

If this fix does not resolve the issue I will try to follow the steps you suggested.

Thank you!