security alert when connecting via endpoint security vpn

[nflnetwork29]

I am trying to locate the setting for SSL certificate in cluster XL 

we are using endpoint security for remote access vpn

the users are all seeing a "security warning" pop up box prior to connection 

I assume a 3rd-party SSL cert would resolve the issue . Can't find where to install the certificate on the Firewall. 

Any ideas?

 

 

[PhoneBoy]

One error message is a result of the clients unable to reach the certificate revocation list, which is stored on the management server.
The other is a result of not trusting the ICA.
You can deploy the ICA to your clients as trusted via GPO to resolve this issue.
You can also add a certificate to the IPSec VPN section of the gateway object and specify which certificate is used for Remote Access here:

[nflnetwork29]

for the CRL issue we are using SAML authentication and Azure AD as our identify provider.  So we do not use any LDAP account Unit . Is there a workaround for this type of setup?

For the certificate issue how do i generate the certificate sign request (CSR) ?

[PhoneBoy]

This is likely the CRL for the certificate used for VPN itself, which is used irrespective of the authentication method used for users.

To generate a CSR, I believe you need to import the Certificate Authority first.
Then you can use the Add button in the IPSec VPN section of the object to generate the necessary CSR.

[vasgogo]

Hello,

We have the same issue,

We are using SAML authentication to Azure. We have imported our CA and created/signed CSR, but the issue is the same.

Does anyone solve this alert? 

[PhoneBoy]

Recommend involving the TAC to troubleshoot.

[jnoble]

Hi, were you able to resolve this issue?

[Elie_Mbayabo]

How did you fix this issue? 

When making the Identity Provider object, if you can not have "Remote Access" as a service option.

1. Verify the URL in the SAML portal settings in the gateway object. 
   1. If using a 3rd party Certificate. The URL must match the Certificate FQDN, <fixed it by changing from IP to FQDN> https://support.checkpoint.com/results/sk/sk172909