Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
abihsot__
Advisor
Jump to solution

IPSec VPN certificate

Hi there,

I wanted to upload 3rd party certificate to the gateway, however the only option is to use "add" button, which in turn would generate private key, CSR and will wait for me to come back with signed certificate and do "complete".

It all would be fine, however I want to upload the same certificate on multiple gateways. I see "export P12", so I assume there is a hidden way to "import P12"?

 

image.png

 

 

 

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

That SK talks about exporting the certificate.
The question is about importing an existing certificate with a private key for IPsec VPN, which is not supported or best practice.
If you generate a new certificate using the same Certificate Authority as the previous certificate, it should work without difficulty.

View solution in original post

0 Kudos
12 Replies
PhoneBoy
Admin
Admin

Don’t believe you can or should use the same certificate on multiple gateways.

0 Kudos
abihsot__
Advisor

I understand your concerns, but there might be cases where it could be beneficial.

I assume "export P12" button is for making backup of certificate + private key, however what is the purpose of such backup if you can't import it?

 

0 Kudos
PhoneBoy
Admin
Admin

I believe that is for the public Certificate Authority key, not the gateway certificate. 

0 Kudos
Yuber_Sierra_av
Participant

Hello @PhoneBoy,

I'm worndering the same as @abihsot__ , in my case I'm replacing old Cluster to new gateway models, so, I need to import the IPSec VPN Certificate which resides in the SMS, but there is no such option to Import the certificate to the new Cluster.

Thank you.

0 Kudos
PhoneBoy
Admin
Admin

That SK talks about exporting the certificate.
The question is about importing an existing certificate with a private key for IPsec VPN, which is not supported or best practice.
If you generate a new certificate using the same Certificate Authority as the previous certificate, it should work without difficulty.

0 Kudos
Fiqri_kurniawan
Participant

Hello Mr. PhoneBoy,

Does the certificate affect for VPN Site 2 site? Or only for VPN Client Remote Access

Thanks

0 Kudos
Aaron_Vivadelli
Contributor
Contributor

It would affect both client to site and site to site, however unless you have site to site VPN tunnels between 2 check point gateways you manage from the same sms, your site to site vpn is most likely using pre shared key instead of certificates.

If you do have site to site VPNs between Check Point gateways managed by the same sms, you just need to install policy to all the other gateways the gateway in question has a vpn to do they are aware of the new cert as well.

In my experience, this change usually has more of an effect on client to site, but it can have an effect if your site to site VPNs use certificates rather than PSK.

0 Kudos
ivdolbnia
Explorer

I see many requests like that online. Also I am facing the similar situation - ability to export/import existing certificate is crucial for proper operational management of the devices. Once we want to swap/replace device or virtual appliance - we need to configure everything from scratch automatically (migrate doesn't work in our case) - I can do everything through API, but we NEED to export/import VPN certificates for our tunnels - otherwise we need to go through very complicated process with CSR (basically fly to another country to get it on CD as this is security requirement). How can we proceed with such feature being added?

0 Kudos
_Val_
Admin
Admin

Backup and restore should cover replacement in most cases. As @PhoneBoy mentioned already, there is a reason it is hard or even impossible to extract a certificate with a private key. It is done for very serious security reasons.

For VPN purposes, you can actually generate a new certificate from a trusted CA. That should not affect tunnel functionalities. As long as VPN peers trust certificates from the other side, you should be fine. 

0 Kudos
RamGuy239
Advisor
Advisor

Third-party VPN certificates have always been rather tedious on Check Point. First, you must create a Trusted CA, then a subordinate CA to get the entire chain trusted on your management server. Then you have to create the CSR based on this, get it signed, and then import and have it trusted.

I don't think you can utilise the same certificate on multiple gateways, as you will have to start with a new CSR per gateway/cluster.

 

This process is much easier and seamless with the Mobile Access blade enabled. In Mobile Access, you can simply import .p12 directly without jumping through all the other hoops:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_MobileAccess_AdminGuide/Cont...

 

But I'm not entirely sure if the certificate you import into the Mobile Access portal will be available to choose as a certificate for Site-2-Site IPsec VPN. When you jump through the hoops not using Mobile Access, your certificate will be available for Site-2-Site IPsec VPN and Remote Access. Not entirely sure if that is the case when using Mobile Access or if it will be available for Remote Access only.

 

 

Certifications: CCSA, CCSE, CCSM, CCSM ELITE, CCTA, CCTE, CCVS, CCME
0 Kudos
PhoneBoy
Admin
Admin

Pretty sure this will not impact anything for Site-to-Site VPN or Remote Access VPN clients that aren't SNX.
We need the Certificate Authorities explicitly defined (the root and any subordinates) in order to correctly verify the certificates in use are still valid.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events