Automatic certificate renewal

[ErikV]

Hello,

With the maximum validity period of certificates becoming shorter all the time it is a challenge for large deployments to renew everything. Is there a known solution to automate this for the remote access solutions of Check Point? And maybe even the Gaia interface as well? (some of our customers even have an external wildcard certificate on their Gaia webinterface). 

Things like certbot don't apply for the VPN solution I guess, or maybe via the API?

Thanks in advance,

Regards,

Erik

[David141824]

Hi everyone,

I'm currently working on automating the VPN certificate renewal process for a customer. I found the official script provided in sk182070 (gateway_cert_util.sh), which works flawlessly for automating internal certificates generated by the Check Point ICA.

However, this customer's scenario involves Mobile Access using a public certificate (Let's Encrypt) to avoid browser SSL warnings for end-users.

Since the script from sk182070 appears to be tied exclusively to the Internal CA, I have two questions:

Is there any undocumented or native way to make the sk182070 script handle public certificates fetched externally?

If not, what is the current best practice the community is using for this? Are you relying on external Linux servers running ACME clients (like acme.sh or certbot) combined with the Management API (mgmt_cli) to upload the .p12 and push the policy?

If anyone has architectural tips, GitHub repos, or script examples to share, it would be highly appreciated.

Thanks in advance!

[PhoneBoy]

From looking at the script, it appears it's only meant to handle ICA scripts.
In theory, this could also handle other types of certificates with some additional logic.
The script is using both published and unpublished Management API calls (e.g. generic-object), suggesting there isn't a "supported" way to do this with the API.