cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Remote Access VPN Certificate

I have a Check Point cluster that has remote access turned on for remote access VPN use.  The certificate that secure remote access is using has been found to be using a weak hashing algorithm and/or a RSA key less than 2048 bits.

 

I am in need of correcting this and have not been able to find a way to make remote access use a different certificate without possibly breaking SIC or my point to point VPN connections.

 

When I go into the gateway cluster properties > VPN Clients - I see that "defaultCert" is selected but have not been successful in finding a way to add a new and more secure certificate.

 

I see there are options in Global Properties from the file / launch menu but am hesitant to change anything in there.

 

 

Can anyone assist?  Thank you.

7 Replies

Re: Remote Access VPN Certificate

Hello,

Try to add it on IPSec VPN tab. Then you should be able change it for VPN Clients.

R

0 Kudos

Re: Remote Access VPN Certificate

Hello,

In the IPSEC options in Gateway Cluster Properties I click on "Add" > enter a certificate name > click " Generate" > and then I receive an error stating "Cannot generate certificate from "internal_ca" Certificate Authority because MY_CLUSTER_NAME already has a certificate generated by "internal_ca" Certificate Authority.

0 Kudos
Jerry
Gold

Re: Remote Access VPN Certificate

all you need really is a p12/capi certificate which can be generated from users group under SmartConsole.

that's all.

Jerry
0 Kudos

Re: Remote Access VPN Certificate

Hi Jerry,

I don't know what a p12/capi certificate is.  The certificate I am trying to replace is the server certificate, not the user or laptop certificates(s).

0 Kudos
Admin
Admin

Re: Remote Access VPN Certificate

The local VPN certificate is actually signed by the Internal CA.

Assuming the remote end is configured to trust certificates signed by the ICA, then replacing the certificate should only involve minimal disruption.

However, the existing VPN certificate must be revoked first.

0 Kudos

Re: Remote Access VPN Certificate

Hi Dameon,

What you are describing is exactly what I need to do, I just don't know how to to do it and can't find instructions.  I am also cautious as I don't want to inadvertently revoke a cert that is used for SIC.

Are you able to point me in the right direction or coach me on how to revoke this VPN cert and generate a new one?

Thank you!

0 Kudos
Admin
Admin

Re: Remote Access VPN Certificate

Yeah, I'm having a little trouble figuring that one out as well Smiley Happy

What happens if you merely "renew" the certificate? 

This should generate you a new certificate and you can review the number of bits to ensure it's correct.

I believe this will require a policy installation to take effect.

Otherwise, I suggest consulting with the TAC.

How To Open a Case with TAC and/or Account Services