Messed up Trusted CAs repository

[nmelay2]

Hi,

I'm in the process of fixing a badly broken HTTPS Inspection configuration.
Not sure what's been done to this management server before, it's been handled by a bunch of admins over time.
Also, it was migrated to Smart-1 Cloud just before I took over, not sure how smooth that process went.
Gateways are clustered 3600s running R81.20.

After fixing many misconfigurations, the main remaining issue is a messed up Trusted CAs repository (old SmartDashboard > HTTPS Inspection > Trusted CAs).
Half of the root CAs are disabled ("removed"), and as a consequence, many websites that go through HTTPS Inspection are considered as untrusted.

While Automatic Updates are enabled, the most recent CA certificates I could see in the list were already a few years old, which I initially though was the issue.
I did not manage to trigger an automatic update, so I ended up manually updating the certificate list from the zip archive (sk64521).
This did add and remove dozens of CAs from the list, but still did not fix the untrusted websites issue.

I checked a few websites and saw that their corresponding root CAs were indeed still missing from the list of trusted CAs.
Then I realized they actually were in the repository, just not in the active/enabled list, and could be added with the Add button.
Clicking "Add" reveals hundreds of "known but disabled" certificates, which is clearly not obvious at first glance.
So yeah, I can add back each missing/disabled root CA, but can only do so one at a time, it takes 12 seconds per certificate, and there's 240 of them (best UI ever guys...)

Did anyone ever encounter such an issue with the Trusted CAs repository?
Do you happen to know a magic undocumented command that would reset the repository to a sane state? (Also, it needs to work on Smart-1 Cloud.)
Anyway I could fix this without spending hours of my life dumb clicking in the (not so) SmartConsole?

Also, I've just setup a lab mgmt, and with the last update, there's 367 CAs there, vs. 444 in my customer's Smart-1 Cloud.
I'm somewhat concerned that old or maybe revoked CAs might still be lying around, which would not be good.
Thoughts ?

[the_rock]

I will check my most updated lab mgmt server on R81.20 jumbo 70 tomorrow and let you know. I also have couple of R82 labs as well, but wont bother checking those, as its totally different version.

Andy

[nmelay2]

Hi Andy,

CA package is probably the same, whatever the Check Point version.

Adding them one by one, 185 to go. 😢

[the_rock]

Crud, sorry, totally forgot to check. Was helping someone from community, they wanted to know some stuff about R82. My apologies, will check tomorrow, but I got a feeling you are probably right.

Andy

[nmelay2]

I don't think I'll be able to check the installed version on the Smart-1 Cloud instance anyway.

All I can see is the package I downloaded was listed as "HTTPS Inspection Trusted CA list (v2.0) 3.5".

(again, best versioning scheme ever...)

And this matches what I got from automatic updates in my lab, according to the commands posted by Kaspars Zibarts a few years back.

[the_rock]

Since guy had few more ?s, I ended up getting info for you. Now, I will go to bed, got up 5 am today lol

Anywho, I attached zip file if you wish to give it a go, it is valid, I tested it, and I also attached screenshot showing difference with R82, as dir is now different and certs are updated in totally different way as well, better may I add.

Andy

 

[PhoneBoy]

Your best bet is to consult with TAC.

[CheckPointerXL]

select the whole list and delete it (by clicking first, shift button to last CA in the list)

after few seconds all the root CA will be correctly added