Capsule Connect VPN Issue(The site's certificate has expired)

[Amber]

Hi all,

I'm encountering a problem. I have a 5000 series gateway (R81.10) managed by SMS (R81.20). Last Friday, I renewed the VPN certificate for the 5000 series gateway. After renewing the certificate, both the IPsec VPN and the desktop Remote Access VPN client are working well.

However, VPN connections from mobile devices using Capsule Connect are not working. When attempting to connect via Capsule Connect, the client displays a message indicating that the site's certificate has expired.

Please suggest. Many thanks.

[the_rock]

Hey Amber,

Can you have them try delete/re-create the site and test? Just have one or two random users do that.

Andy

[Lesley]

You sure the clients trust the new certificate? 

https://support.checkpoint.com/results/sk/sk167255

Just to make sure you done policy push after cert renewal? 

[the_rock]

Good points @Lesley 

[Amber]

Hi Lesley,

When using Capsule Connect to establish a VPN connection, the self-signed certificate does not appear to trust. According to sk167255, the recommended solution is to add a third-party trusted certificate to the Mobile Access Blade.
May I kindly ask if it is possible to use the gateway’s self-signed certificate for Mobile Access instead?

Many thanks.

[Lesley]

Hi

As user still is able not to trust a third party (not self-signed) certificate. If you import certificate without the Intermediate CA and only the certificate systems can complain about it: invalid certificate. Normally you import all Intermediate CA's including the certificate and not the root CA. You can also include root ca but that should not be needed as it is expected that all clients are known with the root ca. 

[PhoneBoy]

You can use the Internal CA for this, but for the error message to go away, the end user will have to manually configure the CA as trusted on their device.

[the_rock]

I guess similar to ssl inspection...maybe not best comparison though.