Check Point gateway sends an expired (and deleted) certificate to Android.

[Igor_Narkevich]

Hi everyone.

R81.20 take 65                  with standalone Nanagement server.

Endpoint Security VPN    (desktops/laptops, Windows & MacOS)
Capsule VPN                     (phones/tabs, Android)

Everything worked until I renewed the IPsec VPN certificate.
Desktops continued working with the new certificate (this can be seen in the log),
but there is a problem with Android.
Check Point gateway sends an expired certificate to Android (visible by fingerprint).

The expired certificate has been deleted on the Nanagement server.

Where does it get it?
And how can I fix this?

[_Val_]

I assume your phones are using Capsule.

First, double-check that you updated the Mobile Access certificate, not just the VPN certificate on the affected GW. Afterwards, reinstall policy.

If the issue still remains, open a TAC ticket. 

[Igor_Narkevich]

double-check that you updated the Mobile Access certificate

I do not know how to do that 😞

Only here

[CheckMatesAI]

This answer is provided by Infinity AI Copilot and should be confirmed by reviewing official documentation in Support Center.

To update the Mobile Access certificate on your Check Point gateway, follow these steps:

1. Log in to SmartConsole:

   • Open the SmartConsole application.

2. Access Gateways & Servers:

   • From the left Navigation Toolbar, click on "Gateways & Servers".

3. Open Security Gateway Properties:

   • Select the relevant Security Gateway object.
   • Navigate to the "Mobile Access" section.

4. Portal Settings:

   • Go to "Portal Settings" under the Mobile Access section.

5. Import or Replace Certificate:

   • In the Certificate section, click on "Import" or "Replace".
   • Choose the new certificate file you wish to use.

6. Install Access Control Policy:

   • After importing the certificate, install the Access Control Policy on the Security Gateway to apply the changes.

For more detailed guidance, you can refer to the Mobile Access R82 Administration Guide.

If you encounter any issues or need further assistance, feel free to ask!

[Igor_Narkevich]

This portal uses an auto-generated certificate.
I renewed the auto-generated certificate.
But GW continues to give out the old (expired and deleted) certificate
and only for mobile devices.

 

[PhoneBoy]

I assume you've installed policy since making these changes?
It might also be worth doing a cprestart on the gateway (requires downtime) to see if that resolves the issue.
Otherwise, I suggest involving TAC.

[Supporto_Checkp]

Same issue - Have you resolved ? How?

[_Val_]

Please open a separate thread for this; this one is from 2024.

You need to restart GW to get a new certificate fetched.