secret key on smart-1?

[Thuan]

Hello experts, During the creation of site-to-site and ssl vpn, I want to know which device generates the private-public key pair and where the private key is stored, in 2 cases: - Case 1: the gw system does not use smart-1 (ngsm), that is, only local management - Case 2: the gw system is managed by a separate smart-1 I have consulted the "Site to Site VPN R81 Administration Guide" document but still feel unclear. Please help me explain.

[G_W_Albrecht]

See https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuid...

[Thuan]

I have read the document you sent. I am aware that:
- ICA is part of Check Point suite used to create SIC trusted connection between Security Gateways, admin authentication and third party servers. The ICA provides certificates for Internal Secure Gateways and remote access clients that negotiate VPN links.
- The ICA Management Tool runs on Security Management Server / Multi-Domain Security Management Server.
However:
- A certificate is automatically issued by the Internal Certificate Authority for all internally managed entities that are VPN-capable. That is, after the administrator enables the IPsec VPN Software Blade in a Security Gateway or Cluster object
- IPSec VPN Software Blade is a feature that belongs to the security gateway.

I am not a checkpoint vpn deployer. I am dealing with this for import and export. What I need to know is where is the vpn private key generated and stored? on the security gateway (such as SG6200) or on the management device (smart-1)?

[PhoneBoy · Accepted solution]

Short answer: the gateway has the private key, both have the public key.
This is consistent with how the RSA cryptosystem works, which is the basis for IPsec VPN, TLS, SIC, and others.

VPN Certificates come from the Internal Certificate Authority (ICA), which exists on the management and is based on the 
Whether it's a device separate from the gateway or the same device (i.e. locally managed) doesn't matter.

When a Check Point gateway is first installed, it generates a unique private key, which is then signed by the ICA when SIC is established.
Much like when you issue a Certificate Signing Request for a certificate to a public CA for a website, the ICA does not need to know the gateway's private key in order to sign the certificate.

We do not provide a mechanism to export private keys from the gateway.
It is trivial (and more secure) to generate a new keypair signed by the same Certificate Authority as before.

[Thuan]

I understand your answer. But can we show the private key.
My colleague has read the documentation but asserts that smart-1 is the source of the private-public key pair.
Quote: "Instead of the Security Management Server generating both public and private keys and downloading them to the module during a policy installation, the management server instructs the module to create its own public and private keys and send (to the management server) only its public key." page 77/Site to Site VPN R81 Administration Guide

[Thuan]

Is there any document that clearly states that: security gateway is where the private key is generated and stored, not smart-1?

[PhoneBoy]

The quote you provided from the documentation confirms the explanation:

• "The management server instructs the module to create its own public and private keys" meaning the management server does not have any keys at this point.
• "send (to the management server) only its public key." meaning the management server only receives a public key from the security gateway

The end result: only the gateway has the private encryption key.
We don't provide a mechanism to show the private key on the gateway.