Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA certific

[Mike_Jensen]

I am running R81.10 with GA Jumbo take 139 installed.

I have a custom IoC feed set to use the Talos blacklist and noticed in my logs the list is failing to update -

"External IOC - External Indicators processing failed
Talos_blacklist: Failed to fetch feed. Resource: https://www.talosintelligence.com/documents/ip-blacklist, Reason: Peer certificate cannot be authenticated with given CA certificates"

I have followed sk169919 and added the websites certificate as well as it's root certificate in the "Trusted CAs" portion of SmartDashboard's HTTPS Inspection, saved my changes, installed access control policy, and the IoC feed still fails to update for the same reason.

I am adding the certificates by going to Actions > "Import outbound Certificate".

I don't know what I am missing to make this work?

[the_rock]

Did you choose the right format?

Andy

[PhoneBoy]

Do you include all the intermediate CAs that are needed to validate the cert?
You might also try the workaround in:  https://support.checkpoint.com/results/sk/sk169919 

[Mike_Jensen]

I must have been missing the intermediate CA's.  Fortunately the latest Check Point updated CA  list has all of the certs I needed.

[Mike_Jensen]

I ended up manually updating the trusted CA's list by downloading the .zip from the link in sk64521, then I followed the rest of that sk to install on my SMS, installed access control policy, and the IoC feed update is now successful.