Remote Access VPN Certificate

[Mike_Jensen]

I have a Check Point cluster that has remote access turned on for remote access VPN use.  The certificate that secure remote access is using has been found to be using a weak hashing algorithm and/or a RSA key less than 2048 bits.

I am in need of correcting this and have not been able to find a way to make remote access use a different certificate without possibly breaking SIC or my point to point VPN connections.

When I go into the gateway cluster properties > VPN Clients - I see that "defaultCert" is selected but have not been successful in finding a way to add a new and more secure certificate.

I see there are options in Global Properties from the file / launch menu but am hesitant to change anything in there.

Can anyone assist?  Thank you.

[Rafal_N]

Hello,

Try to add it on IPSec VPN tab. Then you should be able change it for VPN Clients.

R

[Mike_Jensen]

Hello,

In the IPSEC options in Gateway Cluster Properties I click on "Add" > enter a certificate name > click " Generate" > and then I receive an error stating "Cannot generate certificate from "internal_ca" Certificate Authority because MY_CLUSTER_NAME already has a certificate generated by "internal_ca" Certificate Authority.

[Jerry]

all you need really is a p12/capi certificate which can be generated from users group under SmartConsole.

that's all.

[Mike_Jensen]

Hi Jerry,

I don't know what a p12/capi certificate is.  The certificate I am trying to replace is the server certificate, not the user or laptop certificates(s).

[PhoneBoy]

The local VPN certificate is actually signed by the Internal CA.

Assuming the remote end is configured to trust certificates signed by the ICA, then replacing the certificate should only involve minimal disruption.

However, the existing VPN certificate must be revoked first.

[Mike_Jensen]

Hi Dameon,

What you are describing is exactly what I need to do, I just don't know how to to do it and can't find instructions.  I am also cautious as I don't want to inadvertently revoke a cert that is used for SIC.

Are you able to point me in the right direction or coach me on how to revoke this VPN cert and generate a new one?

Thank you!

[PhoneBoy]

Yeah, I'm having a little trouble figuring that one out as well

What happens if you merely "renew" the certificate? 

This should generate you a new certificate and you can review the number of bits to ensure it's correct.

I believe this will require a policy installation to take effect.

Otherwise, I suggest consulting with the TAC.

How To Open a Case with TAC and/or Account Services‌

[lbcadenco10]

In case anyone comes across this post, here is the SK to increase the key size and renew the VPN cert

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Jeff_Gao]

Dear
I have completed all certificate-base remote access vpn,but it prompt below：

 "Connection Failed:User Email=jeff.gao@example.com,CN=Jeff.gao,OU=IT,DC=example,DC=cn unknow"

I can not search the example from sk or google

GW:R80.30 and take 214

CA：windows server 2019 and together with AD

client:Non-join-AD and trust CA root cert