How to Renew Certificate on Security Gateway.

[AVG132]

Hi All , 

We are having a Security gateway whose certificate is about to expire in 15 days .It was issued by Security Management Server 5 years back. 1.What is a procedure to update this certificate .We are not planning to use external/internal separate CA for this .

2.Is there any impact if this certificate gets expired ?

3.Is there any SK article for this ?

[Tal_Paz-Fridman · Accepted solution]

An expired certificate will mean VPN will fail.

Edit the Security Gateway object.

[AVG132]

Thanks for reply . Is there any config changes required to be done at Security Management Server end as well ?  What are next steps after clicking on Renew /will it renew automatically after this ?

[girisht · Accepted solution]

Hi there,

Renewing the IPSEC repository certificate will only impact the RA VPN and S2S VPN if the certificate is being used. So it would be advised to perform in lean hours. Once the certificate is renewed just push the policy.
Moreover, it doesn't require any changes on the MGMT server side and it will not renew automatically. An admin has to renew the certificate whenever it expires. 
Additional info: sk176527

[anand87]

thanks for the SK 

Can we renew certificate in every 6 months instead of yearly

[PhoneBoy]

You can manually "renew" and set the expiration for 6 months by modifying and executing the script here, which by default renews it for a year: https://support.checkpoint.com/results/sk/sk182070 

[the_rock · Accepted solution]

Just do what @girisht and @Tal_Paz-Fridman said. Btw, its totally safe to even do this in production hours, I had done it at least 20 times and never an issie. Now, to be safe, maybe better off hours, but you will be fine either way.

Also, dont forget to install policy afterwards.

Andy