Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Jerry
Mentor
Mentor
Jump to solution

Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Error: Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.

 

6 SG's and 3 SMS's has at this very time same error - anyone else has it just now or something has happened on the CP Clould side?

would appreciate heads up. 

  Anti-Bot Update Status  
Name Value
Status
 

 

Failed
Description Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.
Next update The next try will be within one hour.
Version 2006022334

 

cheers

Jerry
1 Solution

Accepted Solutions
Dorit_Dor
Employee
Employee

To sum up 

1. Indeed there was a CRL (Certificate revocation list) challenge (Certificate is naturally 3rd party certificate and therefore CRL check is also dependent on the same 3rd party) that caused failure on updates downloads 

2. Indeed the response took more than desired 

3. During the incident, we did identify the issue fast but it was not as easy to resolve and one would have hoped 

4. We take this incident seriously and I am confident that we will avoid this single point of failure in the future.

Thank you for the feedback and collaboration 

Dorit 

BTW Its also opportunity for other IT leaders in the forum to leverage the same lesson and check if there is critical service that is dependent on CRL check. 

 

 

View solution in original post

42 Replies
Ilya_Avetisyan
Contributor
Hi
I see the same with our 4 appliances
Jerry
Mentor
Mentor
meaning we've got an issues with AntiBot Contract(s) entitlement on the CP side - anyone else ?
Jerry
moritz_r
Participant
Participant

Hello @Jerry , it seems there is a issue with the update services from checkpoint. multiple customers complains about this issue and we are facing it as well.
After askning TAC I receved an feedback: "currently having an issue with our cloud and this is the reason for the issue"

I hope it will be solved soon.

Best regards

Jerry
Mentor
Mentor
awesome, would be great if such circumstances could be announced on CheckMates as well in a form of TABLE of the "SERVICE STATUS" or something - don't you think chaps?
@PhoneBoy
@Heiko
@TimHall
@Danny

cheers
Jerry
Jerry
Mentor
Mentor
oh sugar, sorry forgot about that one, cheers Wolfgang! spot on 🙂
Jerry
Jerry
Mentor
Mentor
awesome! works like a charm, cheers!
Jerry
anstelios
Collaborator

Any chance this is resolving the cloud emulation problem also ??

Probably not but has anyone tried it??

Jerry
Mentor
Mentor
my apology, overlooked that post sorry 😞 but now all is crystal clear.

cheers to all ! EOT and awaiting a "fix" 😛
Jerry
HristoGrigorov

No worries. Happy it works for you as well 😀

_Val_
Admin
Admin

All back to normal

_Val_
Admin
Admin

Services are restored. It was an third party issue, just FYI

HristoGrigorov

Third-party is involved in delivering updates? Should I be worried ? 🤔

Jerry
Mentor
Mentor
time for

#cpprod_util CPPROD_SetValue "CPshared//6.0//reserved//libCurl" crl_disable 1 01

am I right Hristo? 🙂

reg. 3rd Party - that's how you call it but in fact it is usually someone called "Supplier" and that isn't anything to worry about 🙂
Jerry
HristoGrigorov

Yes, that command will re-enable CRL checks in curl_cli. But it is 1 0 1 and not 1 01, sorry I fixed it in my post.

You may run curl_cli -v ... after that to test it.

I am personally going to leave it disabled. Don't care too much if CheckPoint certificates are revoked as long as updates are working 🙂

I was joking about the third-party... Think, even your ISP is such one. 😀

Jerry
Mentor
Mentor
[Expert@cp:0]# curl_cli -v -k https://updates.checkpoint.com/WebService/services/DownloadMetaDataService
* Trying 23.217.5.127...
* Connected to updates.checkpoint.com (23.217.5.127) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: HIGH:!RC4:!LOW:!EXP:!aNULL:!SSLv2:!MD5:!aECDH:!EDH
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: crl_disable from registry: 1
* servercert: CRL validation was disabled
* Server certificate:
* subject: CN=*.checkpoint.com
* start date: Jun 4 13:23:27 2020 GMT
* expire date: Sep 7 13:23:27 2022 GMT
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign RSA DV SSL CA 2018
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* servercert: Finished
< HTTP/1.1 200 OK
< Content-Type: text/xml;charset=UTF-8
< Content-Length: 410
< Server: Apache-Coyote/1.1
< Date: Fri, 05 Jun 2020 07:12:05 GMT
< Connection: keep-alive
<
* Connection #0 to host updates.checkpoint.com left intact
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><checkpoint:BusinessFault xmlns:checkpoint="urn:downloadcenter"><checkpoint:BusinessFault><checkpoint:code>002</checkpoint:code><checkpoint:message>Request Invalid</checkpoint:message><checkpoint:details>XML Translation Failed</checkpoint:details></checkpoint:BusinessFault></checkpoint:BusinessFault></soap:Body></soap:Envelope>
Jerry
_Val_
Admin
Admin

There was as CRL issue with signing CA. Which is public, third party. Jerry kinda hinted to in the comments below

HristoGrigorov

@_Val_ I posted yesterday in the morning that there is an issue with CRL validation in curl_cli. I don't know why it took you so long to realize that in CheckPoint 🙂

@Jerry CRL check is still disabled?

_Val_
Admin
Admin

we did know that from the start. you point is?

HristoGrigorov

@_Val_ My point is that investigation started in the morning and notification it is identified and fix implemented came in the evening.

HristoGrigorov

@Jerry Here's output when it is enabled:

* servercert: crl_disable from registry: 0
* servercert: crl_download_timeout: 10
* servercert: crl_weak_validation: 1
* servercert: Calling cp_verify_certificate
* servercert: cp_verify_certificate returned: CURLE_OK

Jerry
Mentor
Mentor
yes, I did notice but I'm on a different topic now so sorry for my late answer - I bet they'll get into the bottom of that, am I right @Valerie ?

cheers guys!
Jerry
_Val_
Admin
Admin

I believe Dorit has addressed this point already. 

Thank you for your feedback.

Jerry
Mentor
Mentor
CRL checks enabled and all works like a charm - why? 🙂
Jerry
_Val_
Admin
Admin

because it is now fixed, AFAIK.

Jerry
Mentor
Mentor
@Val - my reply was to Hristo asking me if it is still disabled on my side 😄
Jerry
HristoGrigorov

@Jerry Look what it says:

* servercert: crl_disable from registry: 1
* servercert: CRL validation was disabled

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 18 Mar 2025 @ 09:30 AM (EET)

    CheckMates Live Greece

    Tue 25 Mar 2025 @ 12:00 PM (MDT)

    Salt Lake City: CPX 2025 Recap

    Tue 08 Apr 2025 @ 12:00 PM (MDT)

    Denver: CPX 2025 Recap
    CheckMates Events