Importing certificates in Check Point gateways for authentication

[Di_Junior]

Hi Mates

I need a hand.

We are currently migrating one of our services (skype for business) from TMG to Check Point. I am using a logical server in order to balance the traffic to our internal servers (3 servers) where the 7 DNS records that serves this application. 

The problem that we are facing is with mobile devices, currently with TMG when a mobile device tries to connects, TMG presents them our certificate issued by Digicert, and everything works fine.

Now that we are migrating to Check Point, we are facing an issue with the certificate. With Check Point, when a mobile device tries to connect, it is presented with self-signed certificate on the internal servers, and the comunication does not work.

We requested the certificate that is being used by TMG, and it is a .pfx file. 

Is there any way we can achieve what is being done by TMG.

We are using R80.20.

Thanks in advance

[PhoneBoy]

Logical Server objects don't have any specific support for HTTPS.
That said, you might be able to combine this with inbound HTTPS Inspection where you can configure it to present the Digicert certificate.
The gateway will need to be configured to trust the CA (or self-signed cert) for the Internal servers.

[Di_Junior]

Hi PhoneBoy

Thanks for the feedback.

"That said, you might be able to combine this with inbound HTTPS Inspection where you can configure it to present the Digicert certificate."

The Digicert certificate is in pfx format, I tried to import it in https inspections but it seems that this pfx is not supported. How can solve this issue?

Thanks in advance

[PhoneBoy]

You just need to convert the certificate using OpenSSL or some other tool.
A couple suggestions here: https://stackoverflow.com/questions/6819079/convert-pfx-format-to-p12

[Di_Junior]

Hi PhoneBoy

I have successfully convertes the certificate into p12.

How do I now present the certificates to clientes when they are trying to connect?

How do I make the gateway to trust this certificate?

You help is much appreciated.

Thanks in advance

[PhoneBoy]

You configure Inbound HTTPS Inspection as described in the documentation: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_NextGenSecurityGateway_Guide...
The certificate you have to configure the gateway to "trust" in this case is the internal CA (or self-signed) certificate(s) the gateway will see when it opens the HTTPS connection to the internal hosts.
This process should also be described in the documentation referenced above.

Like I originally said, this might work.
I don't know for sure it will.

[Di_Junior]

Hi @PhoneBoy

Thanks for your help.
I tried that, and it did not work. I am still getting the self-signed certificate instead of the Digicert certificate.
I have opened a TAC case and still waiting on their feedback.

Meanwhile, Has anyone ever implemented skype for business over a Check Point firewall and got it working? how was it implemented? because this is the only service preventing us from migrating all our services to Check Point.

Thanks in advance

[PhoneBoy]

You should start a separate thread about Skype for Business derailing the configuration and specific issues you’re running into.
I do know you probably need to bypass HTTPS Inspection for those servers.

[Di_Junior]

Hi @PhoneBoy

Thanks. I will open another thread.
Regards