Solved: HTTPS inspection - Create a CSR for an external CA... - Check Point CheckMates

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

1 Solution

Accepted Solutions

emmap

MVP Gold CHKP

‎2025-09-1606:45 PM

Show option menu

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

View solution in original post

We have it documented here: https://support.checkpoint.com/results/sk/sk165856

3\ \ \ Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

15 Replies

MVP Diamond

‎2025-09-1605:54 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Not sure if below steps make 100% sense, but looks okay to me.

Andy

\\\****************

1. Decide Where to Generate the CSR

You can generate the CSR either:

On the Check Point Security Gateway / Management Server (Gaia CLI or SmartConsole)
Externally (Windows/Linux) and then import the signed certificate + private key

Best practice: generate the CSR directly on the Check Point box where the private key will be used, so the key never leaves the device.

2. Generate CSR in Gaia Portal (Easiest)

Log into the Gaia Portal (https://<mgmt_or_gateway_IP>).
Go to:

Device > Certificates > Outgoing Certificates

Click Add > Create Certificate Signing Request (CSR).
Fill in the fields:
- CN (Common Name): typically the FQDN used for outbound TLS (e.g., proxy.company.com)

O (Organization), OU, L, ST, C as required by your CA policy
Key length: 2048 or 3072 bits (depending on your CA requirements)

Save/Generate → This will create a .csr file.
Download the CSR file.

3. Submit CSR to Windows CA

On your Windows CA server:

Open Certification Authority MMC.
Right-click the CA → All Tasks → Submit new request.

Or, if using web enrollment, open:

http://<CAserver>/certsrv → Request a certificate → Advanced certificate request → Submit CSR.

Choose the correct certificate template (e.g., Web Server, Subordinate CA, etc., depending on usage).
Submit and download the signed certificate (usually .cer or .p7b).

4. Import Signed Certificate Back into Gaia

Go back to Gaia Portal → Device → Certificates → Outgoing Certificates.
Select your pending CSR request.
Click Import Certificate and upload the .cer (or export from CA as Base64 if needed).
Once imported, the status will change to Valid.

5. (Optional) CLI Method

If you prefer CLI:

# Create a new private key and CSR openssl req -new -newkey rsa:2048 -nodes -keyout outbound.key -out outbound.csr

Transfer the .csr to your Windows CA, sign it, then bring the .cer back.
Import both .key and .cer into Check Point with cpca_client or via Gaia Portal.

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1711:39 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

There is no such menu in Gaia GUI: Device > Certificates > Outgoing Certificates

I will try what emmap suggested

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-09-1711:42 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Emil_T

Fair enough, its an official CP documentation anyway.

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

emmap

MVP Gold CHKP

‎2025-09-1606:45 PM

We have it documented here: https://support.checkpoint.com/results/sk/sk165856

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-09-1606:49 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to emmap

Perfect, even better!

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1710:01 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

https://community.checkpoint.com/t5/Management/OpenSSL-latest-version-support-for-pkcs12-cert-creati...

I followed sk165856, But instead of step 6 i used the method below (since step 6 failed and generated this error: unable to load certificates

-Run "cpopenssl pkcs12 -export -in inspection-ca.cer -inkey inspection-key.pem -out inspection.pfx"

-After got the certificate in .pfx format, rename it to .p12 format

-Import to smart console.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

emmap

MVP Gold CHKP

‎2025-09-1801:01 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Emil_T

OK, you haven't included the rootCA in there, so if you have trust issues from endpoints that are trusting that root CA that might be why. Let us know how you go anyway.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1808:47 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to emmap

Thx! I'll let you know.

The root-ca is the internal organizational ca, so to the best of my knowledge, every domain member should trust it.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-09-1803:05 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Maybe it was wrong cert extension?

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1808:49 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

I'm not sure. I don't believe file extensions really matter when using openssl

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-09-1808:51 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Emil_T

I am fairly sure to import it into smart console, it would have to be .p12 extension, but I could be mistaken.

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1808:54 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

You are correct. Smart console only looking for p12 file. That's why there is a rename extension step in the workaround I guess.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-09-1808:49 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

So, on step 6, since you said thats where it faisl it only gives that error unable to load certificate?

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Collaborator

‎2025-09-1808:52 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Correct. And seems like I'm not the only one. But with the workaround everything seems to be working. I already made some test and the endpoint can see the certificate that the firewall issues and it is trusted as the root-ca is a trusted CA of the endpoint

Kudos