## HTTPS inspection - Create a CSR for an external CA to use for the outbound certificate How can I create a new CSR  (Certificate Signing Request)  for outbound certificate for external CA ? The CA is a windows CA server. - Tags: - [Certificate Signing Request](https://community.checkpoint.com/t5/tag/Certificate%20Signing%20Request/tg-p/board-id/general-topics) - [CSR](https://community.checkpoint.com/t5/tag/CSR/tg-p/board-id/general-topics) - [external ca](https://community.checkpoint.com/t5/tag/external%20ca/tg-p/board-id/general-topics) - [https inspection](https://community.checkpoint.com/t5/tag/https%20inspection/tg-p/board-id/general-topics) - [Intermediate CA](https://community.checkpoint.com/t5/tag/Intermediate%20CA/tg-p/board-id/general-topics) 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257426?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) - [All forum topics](https://community.checkpoint.com/t5/General-Topics/bd-p/general-topics/page/33 "General Topics") - [Previous Topic](https://community.checkpoint.com/t5/General-Topics/An-idea-from-customer-about-web-UI-jumbo-hotfix-install/td-p/257655 "An idea from customer about web UI jumbo hotfix install") - [Next Topic](https://community.checkpoint.com/t5/General-Topics/Jumbo-Hotfix-Accumulator-for-Quantum-Force-3900-Appliances-take/td-p/257224 "Jumbo Hotfix Accumulator for Quantum Force 3900 Appliances take #22 has been released today") 1 Solution Accepted Solutions [emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) MVP Gold CHKP ‎2025-09-1606:45 PM [Show option menu](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43367) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429/highlight/true#M43367) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43367/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257429) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) We have it documented here: [https://support.checkpoint.com/results/sk/sk165856](https://support.checkpoint.com/results/sk/sk165856) [View solution in original post](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) [3\\ \\ \\ Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/43367/tab/all-users "Click here to see who gave kudos to this post.") [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257429?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) 15 Replies [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1605:54 PM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43366) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257427/highlight/true#M43366) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43366/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257427) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Not sure if below steps make 100% sense, but looks okay to me. Andy \\*\\*\\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ## 1\. Decide Where to Generate the CSR You can generate the CSR either: - **On the Check Point Security Gateway / Management Server (Gaia CLI or SmartConsole)** - **Externally (Windows/Linux)** and then import the signed certificate + private key Best practice: generate the CSR directly on the Check Point box where the private key will be used, so the key never leaves the device. * * * ## 2\. Generate CSR in Gaia Portal (Easiest) 1. Log into the **Gaia Portal** (https://). 2. Go to: **Device > Certificates > Outgoing Certificates** 3. Click **Add > Create Certificate Signing Request (CSR)**. 4. Fill in the fields: - **CN (Common Name):** typically the FQDN used for outbound TLS (e.g., proxy.company.com) - **O (Organization), OU, L, ST, C** as required by your CA policy - **Key length:** 2048 or 3072 bits (depending on your CA requirements) 5. Save/Generate → This will create a `.csr` file. 6. Download the CSR file. * * * ## 3\. Submit CSR to Windows CA On your Windows CA server: 1. Open **Certification Authority MMC**. 2. Right-click the CA → **All Tasks → Submit new request**. Or, if using web enrollment, open: `http:///certsrv` → Request a certificate → Advanced certificate request → Submit CSR. 3. Choose the correct **certificate template** (e.g., Web Server, Subordinate CA, etc., depending on usage). 4. Submit and download the signed certificate (usually `.cer` or `.p7b`). * * * ## 4\. Import Signed Certificate Back into Gaia 1. Go back to **Gaia Portal → Device → Certificates → Outgoing Certificates**. 2. Select your pending CSR request. 3. Click **Import Certificate** and upload the `.cer` (or export from CA as Base64 if needed). 4. Once imported, the status will change to **Valid**. * * * ## 5\. (Optional) CLI Method If you prefer CLI: `# Create a new private key and CSR openssl req -new -newkey rsa:2048 -nodes -keyout outbound.key -out outbound.csr ` ``` ``` - Transfer the `.csr` to your Windows CA, sign it, then bring the `.cer` back. - Import both `.key` and `.cer` into Check Point with `cpca_client` or via Gaia Portal. Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257427?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1711:39 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43397) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257539/highlight/true#M43397) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43397/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257539) [In response to the\_rock](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257427/highlight/true#M43366) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Hi There is no such menu in Gaia GUI: Device > Certificates > Outgoing Certificates I will try what emmap suggested 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257539?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1711:42 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43398) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257540/highlight/true#M43398) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43398/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257540) [In response to Emil\_T](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257539/highlight/true#M43397) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Fair enough, its an official CP documentation anyway. Andy Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257540?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) MVP Gold CHKP ‎2025-09-1606:45 PM [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) We have it documented here: [https://support.checkpoint.com/results/sk/sk165856](https://support.checkpoint.com/results/sk/sk165856) 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1606:49 PM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43368) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257430/highlight/true#M43368) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43368/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257430) [In response to emmap](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429/highlight/true#M43367) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Perfect, even better! Andy Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257430?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1710:01 PM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43402) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257562/highlight/true#M43402) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43402/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257562) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) I followed sk165856, But instead of step 6 i used the method below (since step 6 failed and generated this error: unable to load certificates -Run "cpopenssl pkcs12 -export -in inspection-ca.cer -inkey inspection-key.pem -out inspection.pfx" -After got the certificate in .pfx format, rename it to .p12 format -Import to smart console. [https://community.checkpoint.com/t5/Management/OpenSSL-latest-version-support-for-pkcs12-cert-creati...](https://community.checkpoint.com/t5/Management/OpenSSL-latest-version-support-for-pkcs12-cert-creation/td-p/198769) 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257562?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) MVP Gold CHKP ‎2025-09-1801:01 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43406) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257568/highlight/true#M43406) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43406/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257568) [In response to Emil\_T](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257562/highlight/true#M43402) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) OK, you haven't included the rootCA in there, so if you have trust issues from endpoints that are trusting that root CA that might be why. Let us know how you go anyway. 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257568?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1808:47 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43430) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257639/highlight/true#M43430) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43430/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257639) [In response to emmap](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257568/highlight/true#M43406) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Thx! I'll let you know. The root-ca is the internal organizational ca, so to the best of my knowledge, every domain member should trust it. 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257639?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1803:05 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43411) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257578/highlight/true#M43411) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43411/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257578) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Maybe it was wrong cert extension? Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257578?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1808:49 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43432) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257641/highlight/true#M43432) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43432/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257641) [In response to the\_rock](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257578/highlight/true#M43411) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) I'm not sure. I don't believe file extensions really matter when using openssl 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257641?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1808:51 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43434) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257643/highlight/true#M43434) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43434/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257643) [In response to Emil\_T](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257641/highlight/true#M43432) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) I am fairly sure to import it into smart console, it would have to be .p12 extension, but I could be mistaken. Andy Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257643?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1808:54 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43436) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257645/highlight/true#M43436) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43436/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257645) [In response to the\_rock](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257643/highlight/true#M43434) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) You are correct. Smart console only looking for p12 file. That's why there is a rename extension step in the workaround I guess. 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257645?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1808:49 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43433) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257642/highlight/true#M43433) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43433/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257642) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) So, on step 6, since you said thats where it faisl it only gives that error unable to load certificate? Andy Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257642?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [Emil\_T](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7888) Collaborator ‎2025-09-1808:52 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43435) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257644/highlight/true#M43435) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43435/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257644) [In response to the\_rock](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257642/highlight/true#M43433) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Correct. And seems like I'm not the only one. But with the workaround everything seems to be working. I already made some test and the endpoint can see the certificate that the firewall issues and it is trusted as the root-ca is a trusted CA of the endpoint 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257644?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) [the\_rock](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213) MVP Diamond ‎2025-09-1808:55 AM - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=43438) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257647/highlight/true#M43438) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/43438/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/257647) [In response to Emil\_T](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257644/highlight/true#M43435) [Jump to solution](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257429#M43367) Well, as long as all the relevant certs are included in truster root store on user's PC, then you are good. I made post about this as well. Andy [https://community.checkpoint.com/t5/Security-Gateways/Https-inspection-tip/m-p/219139](https://community.checkpoint.com/t5/Security-Gateways/Https-inspection-tip/m-p/219139) Best, Andy "Have a great day and if its not, change it" 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/257647?t:ac=board-id/general-topics/message-id/43365/thread-id/43365&t:cp=kudos/contributions/tapletcontributionspage&ticket=gutrJ1-YMnIS_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) Post Reply Leaderboard Epsum factorial non deposit quid pro quo hic escorol. | User | Count | | --- | --- | |
[israelfds95](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/93117) | 13 | |
[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670) | 7 | |
[simonemantovani](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/79070) | 5 | |
[emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) | 3 | |
[Steffen\_Appel](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10477) | 2 | |
[Kaspars\_Zibarts](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11456) | 1 | |
[Alex-](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10384) | 1 | |
[Danny](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/687) | 1 | |
[Bob\_Zimmerman](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/27871) | 1 | |
[DH](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25118) | 1 | [View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/general-topics/timerange/one_month/page/1/tab/authors) Trending Discussions [Five Habits That Improved My Check Point Deployments](https://community.checkpoint.com/t5/General-Topics/Five-Habits-That-Improved-My-Check-Point-Deployments/td-p/279760) [Automatically Renew VPN Certificates](https://community.checkpoint.com/t5/General-Topics/Automatically-Renew-VPN-Certificates/td-p/279072) [Snapshot and /boot disk space full](https://community.checkpoint.com/t5/General-Topics/Snapshot-and-boot-disk-space-full/td-p/280183) Upcoming Events Sort by: - [All](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426#) - [Virtual](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426#) - [In-Person](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426#) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) Thu 30 Jul 2026 @ 11:30 AM (CDT) [CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) [Virtual](https://community.checkpoint.com/labels/Virtual) Thu 30 Jul 2026 @ 10:00 AM (PDT) [AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411) [In-Person](https://community.checkpoint.com/labels/In-Person) Tue 11 Aug 2026 @ 11:30 AM (EDT) [New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 13 Aug 2026 @ 11:30 AM (EDT) [Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 08:30 AM (COT) [Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 06:00 PM (COT) [Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 27 Aug 2026 @ 09:00 AM (CEST) [Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914) [In-Person](https://community.checkpoint.com/labels/In-Person) Wed 21 Oct 2026 @ 09:00 AM (BST) [AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505) [CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events) [Top](https://community.checkpoint.com/t5/General-Topics/HTTPS-inspection-Create-a-CSR-for-an-external-CA-to-use-for-the/m-p/257426) About CheckMates - [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage) - [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage) Learn Check Point - [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0) - [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia) - [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix) Advanced Learning - [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm) - [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge) - [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=) - [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification) Resources - [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox) - [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub) - [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog) - [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live) Non-English Discussions - [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish) - [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais) - [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese) - [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese) - [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian) - [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan) YOU DESERVE THE BEST SECURITY We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates) [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/) ©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/) Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.