Avoiding VPN client fingerprint message when changing certificate

[electromichi3]

Hello Guys,

I'm in need to change the Certificate which is represented to the Clients for Remote Access.

As far as I Understand, Checkpoint presents the Fingerprint of the Root CA of the VPN Certificate so the client dont have issues when Certificates are exchanged if they come from the same CA.

Unfortunately we are moving from one CA to another and this is not clearly for me. Also not in SK: Avoiding VPN / SNX client fingerprint message when changing certificate or connecting to a backup si...

We have "vpn.corp.com" as CN/DNS. So I digged already into the registry of my clients and there as mentioned a respective fingerprint for my VPN Infrastructure. 
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\accepted_cn\vpn.corp.com]
"--Fingerprint--"=" XXXX XXX XXX XXX XXXX XXX XXXX XXXX XXX XXXX  XXX XXXX"

1. Question: Can I assign more then one Fingerprint in the Registry  ? So we have an entry for our "vpn.corp.com" and there is currently one Fingerprint. Can I enter the second (new one) to and it will work? Is there an SK for this? 
So it will look like:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\accepted_cn\vpn.corp.com]
"--Fingerprint--"=" XXXX XXX XXX XXX XXXX XXX XXXX XXXX XXX XXXX  XXX XXXX"
"--Fingerprint--"=" YYYY YYY YYY YYY YYYY YYY YYYY YYYY YYY YYYY  YYY YYYY"

2. Question: If the 1. is not a viable option will I be forced to create a new DNS Entry (for example remote.corp.com) to prepare the registry? And also reflect this in the new certificate ? 
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\accepted_cn\remote.corp.com]
"--Fingerprint--"=" YYYY YYY YYY YYY YYYY YYY YYYY YYYY YYY YYYY  YYY YYYY"

3. Question: I did not find the SK where it is cleary mentioned which fingerprint of which certificate checkpoint will present its clients. Is there something? Because even the SK above in the text says "From test host with VPN client installed and existing site created, export the following registry key value data:" 
And this is quite hard in a live environment.

Regards

[_Val_]

It seems, you already did most of your investigative work, @electromichi3 

Funny thing, your post title is almost identical to SK you cannot find.

Look into sk66263, that's all you need.

[electromichi3]

Hello, 

yes as mentioned I found this article, but it is not clear for me if I change the fingerprint if I can enter just a second one in the windows registry. So the client will trust 2 fingerprints, then we migrate the certificate and then we remove the old fingerprint from the client.

I'm in need to let the user trust the old AND the new fingerprint because we cant push the registry key to all clients in the same moment where we replace the cert on the gateway

[_Val_]

Safest is to use different site IDs, such as you described in question 2. I would also check in the lab if you can have two fingerprints for a single site. Most probably not, but worth checking.

Also, are you moving CMA to a different IP or just moving the GW to another MGMT? If former, you can keep your fingerprint.

[Tobias_Moritz]

Regarding to question 3: What the CP VPN client is checking here is the RfC#1751 encoded representation of the SHA-1 fingerprint of the root certificate of your VPN GW SSL certificate chain.

[Jacinto_Rodrigu]

Windows registry does not allow 2 of the same values in a registry key.

Working with support we were told this should work:

"--Fingerprint--"=" XXXX XXX XXX XXX XXXX XXX XXXX XXXX XXX XXXX  XXX XXXX: YYYY YYY YYY YYY YYYY YYY YYYY YYYY YYY YYYY  YYY YYYY"

Has not been tested yet, so if anyone tests, would like to hear back on results.

[Heath_H]

@Jacinto_Rodrigu  - did you ever get a chance to test this to see if it works.

Also, I know that CP uses the RFC 1751 to create the fingerprint in human text, but do they have a tool to determine the fingerprint without installing/replacing the current certificate on a gateway?

Also, do they plan to make it easier to manage the SSL cert for the MAB?  With browsers all enforcing a max validity of 397 days, it means a lot more frequent update of the certificate than in the past, and it's a very manual process with about a dozen steps just to get a proper wildcard cert for a single gateway.

[Tobias_Moritz]

Regarding "Also, I know that CP uses the RFC 1751 to create the fingerprint in human text, but do they have a tool to determine the fingerprint without installing/replacing the current certificate on a gateway?":

--> Maybe, I've never found one. So I used the C code from that RfC, compiled it and used it for converting in both directions. Please take care to use the SHA-1 fingerprint of the root certificate of your VPN GW SSL certificate chain. Not the fingerprint from the actual server certificate or any of the intermediate ones.

$ ./rfc_1751.exe "f9:02:bc:09:9a:9e:58:dc:28:6f:f6:4c:54:dd:71:e0:cf:29:f2:30"
Output: WEAN GAM ANT PRY SURF CURL MEW FEUD HALO LAIR SAUL TUBA
$ ./rfc_1751.exe "WEAN GAM ANT PRY SURF CURL MEW FEUD HALO LAIR SAUL TUBA"
Output: F9:02:BC:09:9A:9E:58:DC:28:6F:F6:4C:54:DD:71:E0

Back in R77 days, I remember it was possible to import the new certificate in SmartDashboard, NOT clicking ok or save, than copy the new fingerprint it shows to you, and than click cancel. Never tried this with R80+ and SmartConsole, maybe it is still working this way.

And as CP is only checking fingerprint of Root CA, there is no need to update trust on clients when you stay with that Root CA while changing server cert every year.

[Heath_H]

That's what I thought, and I just confirmed that I have the same fingerprint on my two clusters that have the same Root CA.  We must have switches Root CAs or the CA must have updated their Root certificate path the last time we renewed as it changed on us and we had to scramble to push out a registry edit to all client so that users didn't get the prompt.

How is everyone handling the need to renew a wildcard certificate every year with the new browser changes introduced over the past year forcing CAs to limit validity to 397 days?  Any done any automation or use any 3rd party certificate management tools to help with this process?

[Heath_H]

Just an update to myself.  It's not the fingerprint of the Root CA, it's the CA that issued the certificate.  So if you are using a traditional public CA that has a 2 tier hierarchy, it's the intermediate CA fingerprint that it used.

DigiCert Global Root CA

--> GeoTrust RSA CA 2018

      ---> portal.example.com

So in that example, it's the fingerprint on GeoTrust RSA CA 2018 that is used by the client for verification.

[Tobias_Moritz]

Could you please double check that?

In all the years I've doing this, it was always the fingerprint of the Root CA, never the one of the issuing CA or any other intermediate CA.

I've even checked some environments this morning, its always the fingerprint of the Root CA which is shown.

[Heath_H]

I did double-check. 

The fingerprint shown from SmartConsole for the MAB certificate:

And the fingerprints for the Root CA and Subordinate CA (from SmartConsole, via the View option):

Click to Expand

Subject: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Not Valid Before: Thu Nov 9 19:00:00 2006 Local Time
Not Valid After: Sun Nov 9 19:00:00 2031 Local Time
Serial No.: 083be056904246b1a1756ac95991c74a
Public Key: RSA (2048 bits)
Signature: RSA with SHA1
Key Usage:
digitalSignature
keyCertSign
cRLSign
Basic Constraint:
is CA
MD5 Fingerprint:
79:E4:A9:84:0D:7D:3A:96:D7:C0:4F:E2:43:4C:89:2E
SHA-1 Fingerprints:
1. A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36
2. KURD NEED ARTY RAID BRAE SOOT LOSE MOOR HOVE FIVE CURD HEWN

Subject: CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Not Valid Before: Mon Nov 6 07:23:45 2017 Local Time
Not Valid After: Sat Nov 6 08:23:45 2027 Local Time
Serial No.: 0546fe1823f7e1941da39fce14c46173
Public Key: RSA (2048 bits)
Signature: RSA with SHA256
CRL distribution points:
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
Key Usage:
digitalSignature
keyCertSign
cRLSign
Extended Key Usage:
serverAuth
clientAuth
Basic Constraint:
is CA 0 levels
MD5 Fingerprint:
A9:5D:7F:13:A6:4A:5E:BE:00:36:4D:8B:E6:7D:EC:ED
SHA-1 Fingerprints:
1. 7C:CC:2A:87:E3:94:9F:20:57:2B:18:48:29:80:50:5F:A9:0C:AC:3B
2. FACT BUSH JOAN OHIO AIDE GREW BETH BLAB ETC BARN AWN ONE

[Heath_H]

Even worse, the fingerprint that the SNX client shows appears to be the fingerprint of the actual certificate, not the Intermediate or the Root CA as is used by the Endpoint Security client.

I just confirmed this on my SNX install.  The fingerprint that the user is prompted to trust (or update every time the SSL certificate is updated) is from the actual SSL Server certificate, not the Intermediate or the Root CA.

Very confusing and hard to tell which fingerprint the user will see.  Check Point needs an SK for this sort of information, so that it's clear which certificate fingerprint is used in which situation.

[bernhard_m]

Just tested and it works! Even with more than two fingerprints...
But be careful not to have any blanks around the ":", at the beginning or the end.

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\accepted_cn\vpn.acme.com]
"--Fingerprint--"="XXXX XXX XXX XXX XXXX XXX XXXX XXXX XXX XXXX XXX XXXX:YYYY YYY YYY YYY YYYY YYY YYYY YYYY YYY YYYY YYY YYYY"

[mrschmi]

Attention no space in between the colon and the 2nd fingerprint !!!

"--Fingerprint--"="XXXX XXXX XXXX XXXX XXXX XXXX:YYYY YYYY YYYY YYYY YYYY YYYY"