Unable to clear status alert in SmartConsole that shows that VPN certificate has expired

[Emil_T]

Status alert in SmartConsole shows that the VPN certificate has expired (The VPN Certificate "CN=XXX VPN Certificate,O=XXX;" expired on XXX). The certificate is not listed anywhere under the gateway properties (VPN tab) or in guidbedit or ICA tool.

The VPN Certificate "CN=Cluster-2 VPN Certificate, O=ng-fw..d3ba3n" expired on Mon Sep 8 22:14:58 2025. To renew it, follow...

Even if I'm disabling the VPN blade, the alert persists

[Expert@HostName]# "cpca_client lscert" command output does not list the certificate in the alert

Certificate deleting and / or renew doesn't help.

All following SK didn't help:

After an upgrade to R81.20 or higher, a status alert in SmartConsole shows that the VPN certificate has expired, although the IPSec VPN blade is disabled in the Security Gateway / Cluster object
https://support.checkpoint.com/results/sk/sk182616

SmartConsole shows a warning or error icon near the Security Gateway / Cluster object about an expiring VPN certificate
https://support.checkpoint.com/results/sk/sk178304

Security Management Server warns about expiring Security Gateway certificates during policy installation
https://support.checkpoint.com/results/sk/sk31539

Expired certificates cannot be deleted from the Management Database
https://support.checkpoint.com/results/sk/sk101049

Version R81.20_T631_JHF_T89

Smart Console version is 81.20.9700
Management was restarted recently and it didn't resolve the issue

[Martijn]

Hi,

Which hotfix is installed? Do you have the latest version of SmartConsole?

If you enable the VPN blade on the gateway object and go to 'IPSec VPN', do you see a valid certificate?
There should be a defaultCert. Is this a valid certificate?

In very rare cases it is something cosmetic and a restart of the SmartCenter might help.

Regards,
Martijn

[Emil_T]

I added the hotfix in the original post.
Smart Console version is 81.20.9700
In 'IPSec VPN', I see a valid certificate (which I created). But the alert is about another certificate, that I don't see.
DefaultCert is not there because it was deleted.
Management was restarted recently and it didn't resolve the issue

[AttiqRahman786]

Try to enable the VPN blade, under IPSEC, renew the expired cert, and install policy. you can also disable the VPN blade after the certificate is renewed.

[Emil_T]

As I mentioned, it is a certificate that is not listed anywhere under the gateway IPSEC properties. How can you renew a certificate that is not listed anywhere under the gateway IPSEC properties?

[the_rock]

I would do what @AttiqRahman786 suggested, that works 100%

[Emil_T]

That solution is incompatible. Please read my reply to @AttiqRahman786 

[the_rock]

I did read it. Thats how I fixed this issue before with clients. I dont believe it has anything to do with cert, but mostly with blade itself.

[Emil_T]

OK. Anyway, as I mentioned, I already enable the VPN blade, and created a new certificate under IPSEC. Did it few times. 

[the_rock]

Here are steps I was referring to, so there is no confusion:

1) enable vpn blade, install policy

2) disable vpn blade, install policy, install database

3) test to see if issue is still there

[Emil_T]

Did that again, but still no change

[the_rock]

Sorry mate, in that case, specially considering all you tried, TAC seems to be best option. One thing to try, if you had not already, open SVmonitor from smart console folder on the PC (I believe under c;/program files (x86)/CheckPoint/R8x.xx/SmartConsole) and see if it gives any other indication there, I actually ended up fixing similar issues before that way.

[AttiqRahman786]

In that case if you are sure the Cert is not listed, try generating a new Certificate with Internal CA and Install policy. this is also mentioned in sk178304. Also I can help you in a remote session if you would prefer.

[Emil_T]

I've already generated a new cert as  mentioned in sk178304, but the issue still persists

[AttiqRahman786]

Well in that case I guess some screenshots might be helpful. There is definitely a cert somewhere that has expired or about to expire.
On a side note, Have you tried ICA management tool? 

[Emil_T]

Yes i tried the ICA tool. As I mentioned in my original post - The certificate is not listed anywhere under the gateway properties (VPN tab) or in guidbedit or ICA tool.

I don't know where else to look

[Lesley]

did you try https://support.checkpoint.com/results/sk/sk182070 ? 

+ https://support.checkpoint.com/results/sk/sk101049 the last part 

If after cleaning the expired certificates from the management database, a warning appears that the deleted VPN certificate is about to expire, then follow these steps to remove the problematic VPN certificate from the involved Security Gateway / Cluster.

[Emil_T]

https://support.checkpoint.com/results/sk/sk182070
It gives me an error:

[Expert@Mngt-Pri:0]# ./gateway_cert util. sh -show all

PRIN: bad interpreter: No such file or directory

But anyway - this script only automates many certificates renewal, where in my case the certificate just not listed. (See below)

Regarding this: https://support.checkpoint.com/results/sk/sk101049,
I mentioned in the original post that "cpca_client lscert" command output does not list the certificate in the alert

[Martijn]

Hi,

Did you involve TAC? Seems something deep in the database.

It is my experience the engineers in TAC have the right tools to find anything in the SmartCenter database. Especially if you are unable to find it.
Sometimes they can help you with a remote session and fix it within minutes.

TAC would be my next step.

Martijn

[AttiqRahman786]

Thats Correct. I had this issue once. It was not a VPN cert, but an expired cert being presented by the Firewall which we could not find anywhere. TAC had to create a special admin account for logging in via ICA Tool. but that also did not help. worth a try though.

But I never had Smart Console complaining about a cert, that I could not find anywhere being used in the object. It has to be there somewhere. worth checking in Mobile Access Blade as well. 

[the_rock]

Same here. @Emil_T ...I believe you also indicated there was nothing in guidbedit either...did you search by EXACT cert name?

[Emil_T]

As I mentioned I already tried the ICA tool - "The certificate is not listed anywhere under the gateway properties (VPN tab) or in guidbedit or ICA tool."

Mobile Access is disabled and I didn't find anything there as well

[AttiqRahman786]

Probably your best bet would be to raise a TAC case. If you find a solution, please let us know here for future reference.

[the_rock]

I totally agree. If all discussed here was already attempted and no luck, best to open TAC ticket.

[Lesley]

Check out the time/date in your screenshot it shows 2022. This should show the last time policy push has been done.

Either your time/date is way wrong or you never did policy push. In both cases it is not good. Incorrect time and date on firewalls / mgmt is killing factor for certificates. 

[Emil_T]

Oh - It's just an example screenshot from CheckPoint SK. Not my real one. But the error is the same

[Lesley]

Ah i understand, then what Martijn and the_rock stated it is time for TAC. You did all the basics and more. There is so much we can do from distance without access. 

[the_rock]

I believe that would show the certificate date though, not the time/date on the fw/management?