Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Jerry
Mentor
Mentor
Jump to solution

Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Error: Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.

 

6 SG's and 3 SMS's has at this very time same error - anyone else has it just now or something has happened on the CP Clould side?

would appreciate heads up. 

  Anti-Bot Update Status  
Name Value
Status
 

 

Failed
Description Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.
Next update The next try will be within one hour.
Version 2006022334

 

cheers

Jerry
0 Kudos
1 Solution

Accepted Solutions
Dorit_Dor
Employee
Employee

To sum up 

1. Indeed there was a CRL (Certificate revocation list) challenge (Certificate is naturally 3rd party certificate and therefore CRL check is also dependent on the same 3rd party) that caused failure on updates downloads 

2. Indeed the response took more than desired 

3. During the incident, we did identify the issue fast but it was not as easy to resolve and one would have hoped 

4. We take this incident seriously and I am confident that we will avoid this single point of failure in the future.

Thank you for the feedback and collaboration 

Dorit 

BTW Its also opportunity for other IT leaders in the forum to leverage the same lesson and check if there is critical service that is dependent on CRL check. 

 

 

View solution in original post

42 Replies
Ilya_Avetisyan
Contributor
Hi
I see the same with our 4 appliances
0 Kudos
Jerry
Mentor
Mentor
meaning we've got an issues with AntiBot Contract(s) entitlement on the CP side - anyone else ?
Jerry
0 Kudos
moritz_r
Participant
Participant

Hello @Jerry , it seems there is a issue with the update services from checkpoint. multiple customers complains about this issue and we are facing it as well.
After askning TAC I receved an feedback: "currently having an issue with our cloud and this is the reason for the issue"

I hope it will be solved soon.

Best regards

0 Kudos
Jerry
Mentor
Mentor
awesome, would be great if such circumstances could be announced on CheckMates as well in a form of TABLE of the "SERVICE STATUS" or something - don't you think chaps?
@PhoneBoy
@Heiko
@TimHall
@Danny

cheers
Jerry
Wolfgang
Authority
Authority
Jerry
Mentor
Mentor
oh sugar, sorry forgot about that one, cheers Wolfgang! spot on 🙂
Jerry
0 Kudos
HristoGrigorov

Posted workaround for the problem earlier today if you are interested:

https://community.checkpoint.com/t5/General-Topics/Failure-to-fetch-updates-from-CheckPoint-servers/...

Jerry
Mentor
Mentor
awesome! works like a charm, cheers!
Jerry
0 Kudos
anstelios
Collaborator

Any chance this is resolving the cloud emulation problem also ??

Probably not but has anyone tried it??

0 Kudos
Wolfgang
Authority
Authority
Jerry
Mentor
Mentor
my apology, overlooked that post sorry 😞 but now all is crystal clear.

cheers to all ! EOT and awaiting a "fix" 😛
Jerry
0 Kudos
HristoGrigorov

No worries. Happy it works for you as well 😀

0 Kudos
_Val_
Admin
Admin

All back to normal

0 Kudos
_Val_
Admin
Admin

Services are restored. It was an third party issue, just FYI

0 Kudos
HristoGrigorov

Third-party is involved in delivering updates? Should I be worried ? 🤔

0 Kudos
Jerry
Mentor
Mentor
time for

#cpprod_util CPPROD_SetValue "CPshared//6.0//reserved//libCurl" crl_disable 1 01

am I right Hristo? 🙂

reg. 3rd Party - that's how you call it but in fact it is usually someone called "Supplier" and that isn't anything to worry about 🙂
Jerry
0 Kudos
HristoGrigorov

Yes, that command will re-enable CRL checks in curl_cli. But it is 1 0 1 and not 1 01, sorry I fixed it in my post.

You may run curl_cli -v ... after that to test it.

I am personally going to leave it disabled. Don't care too much if CheckPoint certificates are revoked as long as updates are working 🙂

I was joking about the third-party... Think, even your ISP is such one. 😀

0 Kudos
Jerry
Mentor
Mentor
[Expert@cp:0]# curl_cli -v -k https://updates.checkpoint.com/WebService/services/DownloadMetaDataService
* Trying 23.217.5.127...
* Connected to updates.checkpoint.com (23.217.5.127) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: HIGH:!RC4:!LOW:!EXP:!aNULL:!SSLv2:!MD5:!aECDH:!EDH
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: crl_disable from registry: 1
* servercert: CRL validation was disabled
* Server certificate:
* subject: CN=*.checkpoint.com
* start date: Jun 4 13:23:27 2020 GMT
* expire date: Sep 7 13:23:27 2022 GMT
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign RSA DV SSL CA 2018
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* servercert: Finished
< HTTP/1.1 200 OK
< Content-Type: text/xml;charset=UTF-8
< Content-Length: 410
< Server: Apache-Coyote/1.1
< Date: Fri, 05 Jun 2020 07:12:05 GMT
< Connection: keep-alive
<
* Connection #0 to host updates.checkpoint.com left intact
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><checkpoint:BusinessFault xmlns:checkpoint="urn:downloadcenter"><checkpoint:BusinessFault><checkpoint:code>002</checkpoint:code><checkpoint:message>Request Invalid</checkpoint:message><checkpoint:details>XML Translation Failed</checkpoint:details></checkpoint:BusinessFault></checkpoint:BusinessFault></soap:Body></soap:Envelope>
Jerry
0 Kudos
_Val_
Admin
Admin

There was as CRL issue with signing CA. Which is public, third party. Jerry kinda hinted to in the comments below

0 Kudos
HristoGrigorov

@_Val_ I posted yesterday in the morning that there is an issue with CRL validation in curl_cli. I don't know why it took you so long to realize that in CheckPoint 🙂

@Jerry CRL check is still disabled?

0 Kudos
_Val_
Admin
Admin

we did know that from the start. you point is?

0 Kudos
HristoGrigorov

@_Val_ My point is that investigation started in the morning and notification it is identified and fix implemented came in the evening.

0 Kudos
HristoGrigorov

@Jerry Here's output when it is enabled:

* servercert: crl_disable from registry: 0
* servercert: crl_download_timeout: 10
* servercert: crl_weak_validation: 1
* servercert: Calling cp_verify_certificate
* servercert: cp_verify_certificate returned: CURLE_OK

0 Kudos
Jerry
Mentor
Mentor
yes, I did notice but I'm on a different topic now so sorry for my late answer - I bet they'll get into the bottom of that, am I right @Valerie ?

cheers guys!
Jerry
0 Kudos
_Val_
Admin
Admin

I believe Dorit has addressed this point already. 

Thank you for your feedback.

0 Kudos
Jerry
Mentor
Mentor
CRL checks enabled and all works like a charm - why? 🙂
Jerry
0 Kudos
_Val_
Admin
Admin

because it is now fixed, AFAIK.

0 Kudos
Jerry
Mentor
Mentor
@Val - my reply was to Hristo asking me if it is still disabled on my side 😄
Jerry
HristoGrigorov

@Jerry Look what it says:

* servercert: crl_disable from registry: 1
* servercert: CRL validation was disabled

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events