- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
I have a Check Point cluster that has remote access turned on for remote access VPN use. The certificate that secure remote access is using has been found to be using a weak hashing algorithm and/or a RSA key less than 2048 bits.
I am in need of correcting this and have not been able to find a way to make remote access use a different certificate without possibly breaking SIC or my point to point VPN connections.
When I go into the gateway cluster properties > VPN Clients - I see that "defaultCert" is selected but have not been successful in finding a way to add a new and more secure certificate.
I see there are options in Global Properties from the file / launch menu but am hesitant to change anything in there.
Can anyone assist? Thank you.
Hello,
Try to add it on IPSec VPN tab. Then you should be able change it for VPN Clients.
R
Hello,
In the IPSEC options in Gateway Cluster Properties I click on "Add" > enter a certificate name > click " Generate" > and then I receive an error stating "Cannot generate certificate from "internal_ca" Certificate Authority because MY_CLUSTER_NAME already has a certificate generated by "internal_ca" Certificate Authority.
all you need really is a p12/capi certificate which can be generated from users group under SmartConsole.
that's all.
Hi Jerry,
I don't know what a p12/capi certificate is. The certificate I am trying to replace is the server certificate, not the user or laptop certificates(s).
The local VPN certificate is actually signed by the Internal CA.
Assuming the remote end is configured to trust certificates signed by the ICA, then replacing the certificate should only involve minimal disruption.
However, the existing VPN certificate must be revoked first.
Hi Dameon,
What you are describing is exactly what I need to do, I just don't know how to to do it and can't find instructions. I am also cautious as I don't want to inadvertently revoke a cert that is used for SIC.
Are you able to point me in the right direction or coach me on how to revoke this VPN cert and generate a new one?
Thank you!
Yeah, I'm having a little trouble figuring that one out as well
What happens if you merely "renew" the certificate?
This should generate you a new certificate and you can review the number of bits to ensure it's correct.
I believe this will require a policy installation to take effect.
Otherwise, I suggest consulting with the TAC.
In case anyone comes across this post, here is the SK to increase the key size and renew the VPN cert
Dear
I have completed all certificate-base remote access vpn,but it prompt below:
"Connection Failed:User Email=jeff.gao@example.com,CN=Jeff.gao,OU=IT,DC=example,DC=cn unknow"
I can not search the example from sk or google
GW:R80.30 and take 214
CA:windows server 2019 and together with AD
client:Non-join-AD and trust CA root cert
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY