Machine Authentication Pre-Windows Login Certificate Issue on Check Point Remote Access VPN

[AshleyM]

Hello CheckMates Community,

I'm reaching out for some insights regarding a challenge I'm facing with the Check Point Remote Access VPN. Although the initial setup and machine authentication seem to be working fine, I'm encountering a specific issue at the pre-Windows login phase: the authentication certificate required for login isn't showing up.

Brief Overview of the Issue:

• Successfully set up the Check Point Remote Access VPN and machine authentication. VPN authenticates with machine cert and SAML once logged into windows.
• The problem occurs at the pre-Windows login stage, where no certificate appears for authentication. SDL is enabled for this, so the VPN client is available at pre-windows login.

Troubleshooting Attempts:

• Checked the certificate's installation in the Windows certificate store.
• Configured the VPN client settings to align with certificate requirements.
• Investigated potential group policy restrictions impacting certificate usage.
• Updated the VPN client and related drivers.

Despite these steps, the issue remains unresolved. I'm hoping someone in the community might have encountered a similar situation or could offer some advice. Any suggestions or guidance would be greatly appreciated.

Here is some system information:

Host OS = Windows 10

Firewall version = R80.40 (with latest HF)

Here are some guides I've followed:

https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN...

Solved: Re: Secure Domain Logon with certificate based aut... - Check Point CheckMates

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-...

Looking forward to your responses and thank you in advance for your help!

[PhoneBoy]

Where is the certificate stored in this case?
See also: https://support.checkpoint.com/results/sk/sk121173 

[AshleyM]

Hi, my machine cert is in the personal store, intermediate in the intermediate and the root in the root. The Management server has also got both the Intermediate and the root certs installed. This is because the machine cert is signed by the intermediate as is the server cert configured on the gateway

Thanks for the link you shared, however I am using R80.40 on the gateway.

[PhoneBoy]

You're trying to use a CAPI certificate for SDL.
This is not supported and is noted as such in the product documentation: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN...