Configuration of MTA SMTP/TLS Connection | Which Certificate Format

[marius_kade]

Hi Everybody

I want to set up the SMTP/TLS configuration with a certificate on our Checkpoint cluster under MTA.

I have summarized the certificate in a .p12, as this is the file type Checkpoint wants. At least it can only be uploaded as .p12.
I have executed the following command:
openssl pksc12 -export -out cert.p12 -inkey key.pem -in fullchain.pem

Then the password query appears and I have tried everything. Even with a two-digit password that I have entered correctly, the import always fails with this error message:

Is there something wrong with the format that I need to be aware of?

Thanks for your help!
Marius

[AkosBakos]

Hi @marius_kade 

What is the version? R81.20 take ?

Here is an sk: https://support.checkpoint.com/results/sk/sk123237

"Failed to import outbound certificate. Check that the certificate's format is suitable and that the correct password has been entered"

Maybe you are under take 70.

Akos

[marius_kade]

Hi @AkosBakos ,

thanks for your reply. 🙂

We are currently on R81.10 Take 150
But i can see in Take 152 the problem may be solved. I will check if my certificate is using SHA 256 hashing algorithm tomorrow and maybe do an update to Take 152.
I will come back and report.

Thanks,
Have great day!

[AkosBakos]

Hi @marius_kade 

Great, but I suggest you to consider the upgrade 🙂

Akos

[PhoneBoy]

Have you verified the .p12 file contains all the relevant information?
It should contain the private key and the entire (public) certificate chain (CA and all intermediates).

[marius_kade]

Yes, the .p12 contains the certificate, key and fullchain.
Creted with this command:
openssl pksc12 -export -out cert.p12 -inkey key.pem -in fullchain.pem

Inside the fullchain.pem are these certificates in this order:
cert - intermediate1 - intermediate2 - root(CA)

Thanks!

[PhoneBoy]

Looks like this may be the issue: https://support.checkpoint.com/results/sk/sk123237
Upgrade to JHF 152 or above.