Multi-Portal certificates does not renew

[BG]

Hi all,

Mobile Access and IPSec VPN blades are enabled on firewall (R81.20 JT89). A couple of days ago certificate was expiring so we used "SmartConsole -> IPSec VPN -> Repository of Certificates Available to Gateway" section to renew certificate. From there it seems that certificate is renewed but if we access to mobile access portal page or usercheck page, these portals are still using old certificate. Also Identity Collector agents can not connect to gateway because of expired certificate. We also tried to use script provided in the https://support.checkpoint.com/results/sk/sk182070 but still old certificate is in use.

Is this a TAC case or am I missing something?

[G_W_Albrecht]

After the script from sk182070 was used to renew, what does ./gateway_cert_util.sh -show all show ? You did perform a policy install after renewal ?

[BG]

Hi,

Command output is below. After renewing certificate with the script we have installed the policy. 

[G_W_Albrecht]

Better contact TAC (after rebooting all to be sure)...

[BG]

A reboot solved the problem. Thanks.

[PhoneBoy]

Believe this is a known issue currently that will be fixed in a future JHF.
I believe it is vpnd that needs to be restarted here (though a cprestart or reboot will also solve it).

[Lesley]

There are 2 certificates, one that is used for MAB and other one for IPSec VPN. Did you renew both?

Gateway -> Mobile access -> portal settings

[Lesley]

Extra tip

https://support.checkpoint.com/results/sk/sk177903