Who rated this post

This whole thread is full of really great questions.  Questions that I have not seen any good answers to from Checkpoint anywhere. The fact that you can't generate a CSR without a CA is beyond bizarre to me and I can't think of any good reason for that.  The additional limitations to having more than one certificate to a "CA object" and not being able to have two identical cert chains referenced in different "CAs objects" make it impossible to use two certificates from the same CA using the same cert chain.

Certificate changes are a routine operational task and it should be as simple as generate a CSR (no need for CA cert chain ahead of time) get the CSR signed by 3rd party, upload signed certificate bundle to complete the installation, and then change the reference to the certificate used for whichever service needs a cert change.  None of that should be disruptive in any way and when the certificate reference is changed the new public key and certificate get provided for any connections established after that point.  Fallback is as simple as changing the reference back to the old certificate.  

I am blown away at how complicated such a simple task is for Checkpoint to pull off.