VPN user certificate expire dates feature - gone in R82?

[Daniel_Kavan]

Hi mates,

I noticed that the feature to see a list of VPN user certificates and when they expire is no longer in the Mobile Access R82 dashboard.   Is the ICA tool now recommended for this?

R82 Remote Access VPN Administration Guide

[the_rock]

I noticed that too the other day, lets see if someone can confirm for sure.

Andy

[the_rock · Accepted solution]

Hey Dan,

I just confirmed with our SE that ICA mgmt tool is indeed recommended way to this in R82.

Best,

Andy

[the_rock]

@Daniel_Kavan 

If you nneed anything tested in that tool, let me know, I have it set up in the lab.

Andy

[Daniel_Kavan]

Thanks!    The ICA Management Tool

Funny you ask.   So, I have the tool turned on, however I can't connect to it from my browser.

Expert@mgt1:0]# cpca_client set_mgmt_tool print
Management tool is ON.
Using SSL.
The authorized administrators:

.....................Hmmm...can't reach this page

[the_rock]

Just do below and it will work, then access it on http://mgmt_ip:18265

I mean, its mgmt server, so not a big issue if this has to be doneon port 80. I cant make this work in my lab either, its mgmt I upgraded to R82, but works fine on CLEAN mgmt server.

Andy

[Expert@CP-MANAGEMENT:0]# cpca_client set_mgmt_tool on -no_ssl
Management tool is ON.
Not using SSL.
The authorized administrators:
(
: ("CN=john_smith,OU=users,O=CP-MANAGEMENT..pi6w5j")
)
The authorized users:
()
The authorized custom users:
()
[Expert@CP-MANAGEMENT:0]#

[Daniel_Kavan]

Yes, I can connect with -nossl. 

 A new issue now (sorting), if I put 31-Dec-2025 in the valid to column, I still see certs that expire in 2026.  I just want to see the certs that expire in the next 30 days so I can renew them.

Also, what does remove expired certs do exactly, would it remove the revoked certs.   I put a check in the box for a revoked cert than clicked the option to remove selected certs and nothing happened.  It's still there.

In summary, at least so the ICA management tool is not real helpful.

[the_rock]

Now, you demand too much lol. For every NEW issue, its new post...jk : - )

Awywho, let me try this in my lab.

Andy

[the_rock]

What do you get if you search as what I attached?

Andy

[the_rock]

Btw, I just removed all revoked certs in the lab from ica web page, rebooted mgmt server, still all good.

Andy

[Daniel_Kavan]

no such luck for me, I'll open an issue with TAC.

[the_rock]

Yea, lets see what they say. Im still trying to fix this to work with ssl on, makes no sense why it does not.

Andy

[Daniel_Kavan]

That shows expired certs but the idea is to renew them/catch them before they expire.

[the_rock]

Btw, this is how you fix it with ssl on. I will make separate post about it.

Andy

https://support.checkpoint.com/results/sk/sk115742