Not sure if below steps make 100% sense, but looks okay to me.
Andy
******************
1. Decide Where to Generate the CSR
You can generate the CSR either:
Best practice: generate the CSR directly on the Check Point box where the private key will be used, so the key never leaves the device.
2. Generate CSR in Gaia Portal (Easiest)
-
Log into the Gaia Portal (https://<mgmt_or_gateway_IP>).
-
Go to:
Device > Certificates > Outgoing Certificates
-
Click Add > Create Certificate Signing Request (CSR).
-
Fill in the fields:
-
CN (Common Name): typically the FQDN used for outbound TLS (e.g., proxy.company.com)
-
O (Organization), OU, L, ST, C as required by your CA policy
-
Key length: 2048 or 3072 bits (depending on your CA requirements)
-
Save/Generate → This will create a .csr file.
-
Download the CSR file.
3. Submit CSR to Windows CA
On your Windows CA server:
-
Open Certification Authority MMC.
-
Right-click the CA → All Tasks → Submit new request.
Or, if using web enrollment, open:
http://<CAserver>/certsrv → Request a certificate → Advanced certificate request → Submit CSR.
-
Choose the correct certificate template (e.g., Web Server, Subordinate CA, etc., depending on usage).
-
Submit and download the signed certificate (usually .cer or .p7b).
4. Import Signed Certificate Back into Gaia
-
Go back to Gaia Portal → Device → Certificates → Outgoing Certificates.
-
Select your pending CSR request.
-
Click Import Certificate and upload the .cer (or export from CA as Base64 if needed).
-
Once imported, the status will change to Valid.
5. (Optional) CLI Method
If you prefer CLI:
-
Transfer the .csr to your Windows CA, sign it, then bring the .cer back.
-
Import both .key and .cer into Check Point with cpca_client or via Gaia Portal.
Best,
Andy
