Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
StackCap43382
Contributor
Contributor
Jump to solution

HTTPS Inspection Certificate Expired - No Warnings?

Hi All,

 

Just had to renew a HTTPS certificate that expired yesterday and caused an outage this morning.

 

I cant see any warning in the policy install, audit logs or logs and there is no mention in the ARTG etc.

 

I know better warnings about VPN Cert expiry has been added.

 

Am I missing something obvious?

 

 

 

CCSME, CCTE, CCME, CCVS
0 Kudos
1 Solution

Accepted Solutions
matangi
Employee
Employee

Hi @StackCap43382,
Thanks for your valued feedback.

We introduced a new HealthCheck Point (HCP) test to verify the expiration date of the HTTPS Inspection outbound certificate.

The test will be included in an upcoming release of HCP.

The possible results for the test are as follows:

# SUCCESS - No issues detected. The certificate is valid and will not expire in the next 60 days.

# WARNING - The certificate will expire within the next 60 days.

# ERROR - Issues detected that need immediate action. The certificate is either expired or not yet valid.

HTTPSi outbound cert.PNG

Thanks,
Matan

View solution in original post

0 Kudos
16 Replies
StackCap43382
Contributor
Contributor

I don't see anything there about HTTPS Certificate expiration warnings. 

CCSME, CCTE, CCME, CCVS
the_rock
Legend
Legend

Im almost positive you dont get warning for that, at least I never seen it in any customer's environment or in multiple labs where I had it enabled (R80.30, R80.40, R81.10 and R81.20). You can certainly confirm with TAC, but Im 99.99% sure there is no warning pop-up for inspection cert.

I know, it would make total sense to receive it, but guess not there.

Andy

StackCap43382
Contributor
Contributor

I've also not seen anything going back to r77.30.

I've opened a case with TAC to be 100% sure.

I have noticed there is a API command in the latest 1.9.1 version of the MGMT API that appears you can extract HTTPS certificate details.

mgmt_cli show outbound-inspection-certificate
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-outbound-inspection-certificate...

 

 

 

CCSME, CCTE, CCME, CCVS
0 Kudos
the_rock
Legend
Legend

Correct, this is just in my lab, which also matches below screwenshot in legacy https inspection smart console. I believe max validity is 15 years.

Andy

 

valid-from: "14-Sep-23"
valid-to: "31-Dec-37"

 

Screenshot_1.png

0 Kudos
Martin_Raska
Advisor
Advisor

I had the same problem, my certificate expired after 5 years. No warnings either. I had to renew and set a long expiration date.

0 Kudos
the_rock
Legend
Legend

Makes sense...I hope someone from Israel sees this post and they make that change, as I agree 100%, it would be very convenient to have warning at least 6 months in advance, thats more than enough time.

Andy

0 Kudos
StackCap43382
Contributor
Contributor

Ticket Raised with TAC.

Confirmed no current method to monitor.

Requested to raise RFE. 

 

In case anyone wants to use API to pull Cert Experation:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-outbound-inspection-certificate~v1.9%20

 

CCSME, CCTE, CCME, CCVS
0 Kudos
the_rock
Legend
Legend

I had been super busy with other more pressing CP issues, but still working on this, not giving up.

Andy

0 Kudos
matangi
Employee
Employee

Hi @StackCap43382,
Thanks for your valued feedback.

We introduced a new HealthCheck Point (HCP) test to verify the expiration date of the HTTPS Inspection outbound certificate.

The test will be included in an upcoming release of HCP.

The possible results for the test are as follows:

# SUCCESS - No issues detected. The certificate is valid and will not expire in the next 60 days.

# WARNING - The certificate will expire within the next 60 days.

# ERROR - Issues detected that need immediate action. The certificate is either expired or not yet valid.

HTTPSi outbound cert.PNG

Thanks,
Matan

0 Kudos
the_rock
Legend
Legend

Thats perfect, good news @matangi 

I pray you are safe over there and I pray for peace 🙌🙌

Andy

0 Kudos
matangi
Employee
Employee

Thank you @the_rock 😍

0 Kudos
StackCap43382
Contributor
Contributor

Thank you for adding this to the HCP tool.

The issue is that I still consider HCP a power user tool as the vast majority of customers either don't know its there or run it often enough to pick up on this before its too late.

The alert/notification should require no manual action from the administrator (run the script) and should be a management notification.

There are several functions/faults that generate a popup on Smart Console login, this should be one of them. 

 

CCSME, CCTE, CCME, CCVS
0 Kudos
the_rock
Legend
Legend

I really love the fact that web version was possible for HCP starting in R81.10

Below is what it looks like in my R81.20

Andy

 

 

 

Screenshot_1.png

 

 

0 Kudos
Izhar_Shoshani_
Employee
Employee

We are working to integrate the hcp alert into the Mgmt/SmartConsole. This is planned for next version. 

the_rock
Legend
Legend

Great news @Izhar_Shoshani_ 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events