Change RSA Key 2048 to 4096 to Client VPN

[Ks07]

I am changing the size of the RSA Key 2048 to 4096 to Client VPN because I have a customer who did a vulnerability scan and they indicated that the RSA Key of the certificate of the public ip with which the users are authenticated by VPN with Endpoint Security is vulnerable in 2048 bits so the procedure of sk96591 was performed in the section “VPN Certificate, User Certificate, Client Certificate”.

https://support.checkpoint.com/results/sk/sk96591

I got stuck on the last part that says “Generate the VPN / User / Client Certificate again”.

At first I thought it was the “ipsec VPN” certificate but validating the certificate I had a Public RSA Key of 1024 bits but in the ica management tool I found that it was configured by default 2048, this made me suspect that this is not the certificate that I should renew or generate again.

Could someone tell me what is the exact certificate that is used for the remote VPN's of the users. The users are authenticated by username and password not by certificate, the certificate is only for the authentication of the VPN communication.

I tried to renew the “Ipsec VPN” certificate but when I renewed it I still got 1024, additionally this does not match with the configuration in the Ica Management Tool that had 2048.

In case I have to generate the certificate in the Ica Management Tool, where do I import it?

[Ks07]

[the_rock]

Will test this in the lab tomorrow and see if I can make it work.

Andy

[the_rock]

I just tested it and worked fine, not sure what step you may have missed.

Andy

[the_rock]

Disregard my last response, still shows same in my lab, I asked a colleague about it, he actually teaches CP classes, Im sure he may know.

Will keep you posted.

Best,

Andy

[Ks07]

Hi Andy, good morning.

Precisely where I got stuck is in the last point "4“Generate the VPN / User / Client Certificate again”" as I understand that you must generate the certificate again in “Ica Management Tool” and then import it in the same checkpoint but I do not understand where, additionally I have the doubt if that certificate is the “ipsec VPN” and at the same time I have the doubt about the discrepancy of the bits I see in the ica mangemente tool and the bits I see in the certificate of ipsec vpn.

[the_rock]

I got you, I dont give up easily. My colleague gave this sk, but this is what I tried already. We will do remote later and see if we can figure it out.

Andy

https://support.checkpoint.com/results/sk/sk96591

[Ks07]

Hi Andy, good morning.

That SK is the one I already made using the procedure of: “VPN Certificate, User Certificate, Client Certificate”.

In the last point number 4 where it says generate is where I got stuck.

[the_rock]

Leave it with me, I will update you later.

Andy

[the_rock · Accepted solution]

@Ks07 

I got it. You need to do below part as well.

Andy

After that, you  will see the change.

 

[Ks07]

Hi Andy, good morning, thank you,

I understand, just could you confirm me something, that certificate is also used for users who connect via VPN through “Endpoint Security”?

Would this change affect my VPN S2S? or what impact could it have?

[the_rock]

I cant say 100% it will work in your case unless you try. I tested in my lab, no issues with Azure vpn tunnel OR remote access, did not have to even delete/re-create the site.

Andy

[the_rock]

Maybe, just to be on safe side, I would do it after hours.

Andy

[the_rock]

Forgot to mention, there is no way sadly to make change like this for only group of users, it is global : - (

Andy

[the_rock]

Also, word of caution, sorry to "hit" you with so many updates...

MAKE sure NOT to change first value to anything higher than 2048, because if you use ssl inspection, block page will NOT show up properly if you do (just leave it as 1024 or 2048)

Best,

Andy

 

[Ks07]

Gracias Andy, hice la prueba también en un laboratorio para tener controlado el procedimiento y en efecto, eso me faltaba.

Saludos,

[the_rock]

I understood, welcome 🙂