HTTPS-inspection certificate

[Cyrus]

Hello,

I have a gateway with Web Application and HTTPS-inspection. HTTPS-inspection certificate is going to expire, but it's set to bypass!

CA certificate is installed on all our Client.

The Web-Application is completely active.

I would rather not renew the certificate.

Now I want to know, I'm going to get in trouble, or it's not impotent?

Thank you 

[the_rock]

If cert is going to expire,you need to renew and then send to users again. Thats done from legacy dashboard as per below screenshots.

Andy

 

 

[the_rock · Accepted solution]

I saw the email with your question @R_Y 

Though seems it was deleted, I will answer it regardless 🙂

Im fairly positive nothing would happen if you renewed the cert, as I did this with 2 customers before. Just MAKE SURE users get correct https inspection certificate once renewed, no need to change any other config/rules.

HTH

Andy

Have a nice weekend

⚽

[the_rock]

One thing @R_Y that I forgot to mention : - )

I had customer do this in midday hours (very small company) and it was fine. We simply sent the renewed cert to few users and everything worked like a charm, nothing else was changed.

Now, I will go watch some football (or soccer as our American friends call it) and cheer for my favorite team, AC Milan

🇮🇹

[Dave]

Hello Andy,

I'm in the same situation where i have to renew the outbound https inspection certificate but i'm a bit hesitant to push the 'renew certificate' button as i have no idea what the consequences are.

What will happen once i do this? Will all users be impacted until the certificate renewal process has been rounded off properly?

What will the workflow look like once i clicked on 'renew certificate'? Would be good if you could post some screenshots from this as well since this is the first time i have to do this and don't want to create an outage at the customer.

[the_rock]

Hey @Dave ,

I dont foresee any issues myself in such a scenario. I had done it many times in the lab and worked fine, all I had to do is distribute renewed cert to machine behind the firewall and that was it, worked like a charm afterwards.

I sort of compare it to if you say make bunch of changes in smart console, but only save it and dont install the policy...in case like that, firewalls would not be affected, since those changes would not have been pushed as of yet.

Makes sense?

If you need help with it, Im willing to do remote and show you in my lab.

Cheers mate.

Andy

[Dave]

Current https inspection cert is signed by our RootCA, the RootCA cert is installed on all machines, so i assume once i renew the https inspection cert that this is to be trusted automatically and i don't have to deploy this renewed https inspection cert to all host?

Is my hypothesis making sense here or i'm missing something 🙂

Because currently, when i check the https cert being in use and configured on our gateway, this cert is nowhere to find on my client pc in Trusted Root Certification Authorities certificate store or anywhere else.

So, i'm confused.

Thanks a bunch already 🙂

Dave

[the_rock]

I always had to move the cert over to test machine, so Im fairly sure that will have to be done.

Cheers,

Andy

[Dave]

Even when your https cert has been signed by the subCA of your internal PKI, and not Checkpoint CA?

[the_rock]

Ok, sorry, in that case, Im pretty sure you dont need to do anything, correct.

Andy