## HTTPS Inspection, SNI and CN in generated certificate We're having the following issue: - Security Gateway with Application Control/URL Filtering/HTTPS inspection (R80.10) - Improved HTTPS Inspection Bypass feature (Probe Bypass) as per sk104717 not enabled - Client wants to access a certain URL (let's call it [https://host.inter.net/)](https://host.inter.net/)) and connects to IP of this host via port 443. IP is hosted on AWS - Client sends SNI in Client Hello with value of "host.inter.net" - Security Gateway performs HTTPS inspection and generates SSL certificate with Common Name of "\*.us-east-1.es.amazonaws.com" and sends this to client in Sever Hello - Client sends TLS Alert "Bad Certificate" to server and closes connection Obviously this is happening because the Security Gateway does not use the SNI sent from the client as the CN in the certificate it generates and presents to the client. Does anyone else have this or similar issues? How do you work around it? - Tags: - [https - inspection](https://community.checkpoint.com/t5/tag/https%20-%20inspection/tg-p/board-id/general-topics) - [https inspection](https://community.checkpoint.com/t5/tag/https%20inspection/tg-p/board-id/general-topics) [1\\ \\ \\ Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/7705/tab/all-users "Click here to see who gave kudos to this post.") [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/36630?t:ac=board-id/general-topics/message-id/7705/thread-id/7705&t:cp=kudos/contributions/tapletcontributionspage&ticket=n69dryDOKTlQ_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630) - [All forum topics](https://community.checkpoint.com/t5/General-Topics/bd-p/general-topics/page/395 "General Topics") - [Previous Topic](https://community.checkpoint.com/t5/General-Topics/Your-opinion-matters/td-p/36762 "Your opinion matters!") - [Next Topic](https://community.checkpoint.com/t5/General-Topics/What-is-now-status-of-command-sysconfig-in-R80-and-above/td-p/36355 "What is now status of command sysconfig in R80 and above?") 3 Replies [Vincent\_Bacher](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/16383) MVP Silver ‎2019-02-2706:16 AM [Show option menu](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=7706) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36631/highlight/true#M7706) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/7706/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/36631) Hello, we are facing simiar issues at a customers environment with SNI and don't really have a solution, yet. This is a reason to attend R80.30 EA because of SNI improvement and I am curious about the testing results. cheers Vincent and now to something completely different - CCVS, CCAS, CCTE, CCCS, CCSM elite [1\\ \\ \\ Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/7706/tab/all-users "Click here to see who gave kudos to this post.") [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/36631?t:ac=board-id/general-topics/message-id/7705/thread-id/7705&t:cp=kudos/contributions/tapletcontributionspage&ticket=n69dryDOKTlQ_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630) [Alessandro\_Marr](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/5423) Advisor ‎2019-02-2709:39 AM [Show option menu](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=7707) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36632/highlight/true#M7707) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/7707/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/36632) [In response to Vincent\_Bacher](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36631/highlight/true#M7706) same way on R80.20 Take 33 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/36632?t:ac=board-id/general-topics/message-id/7705/thread-id/7705&t:cp=kudos/contributions/tapletcontributionspage&ticket=n69dryDOKTlQ_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630) [Chinmaya\_Naik](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25509) Advisor ‎2019-02-2802:18 AM [Show option menu](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=7708) - [Permalink](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36633/highlight/true#M7708) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/7708/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/36633) Hiii [Vincent Bacher](https://community.checkpoint.com/migrated-users/50398) ‌ You can use **Hotfix** on the top of R80.10 jumbo take. NOTE: Make sure that, that Hotfix is dependent on the jumbo take. Also If somehow SNI is not able to verify then its work according to the CN. I am not tested yet with R80.30 but from R80.30 onwards SNI is included with below improvements. #Chinmaya Naik 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/36633?t:ac=board-id/general-topics/message-id/7705/thread-id/7705&t:cp=kudos/contributions/tapletcontributionspage&ticket=n69dryDOKTlQ_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630) Post Reply Leaderboard Epsum factorial non deposit quid pro quo hic escorol. | User | Count | | --- | --- | |
[israelfds95](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/93117) | 13 | |
[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670) | 7 | |
[simonemantovani](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/79070) | 5 | |
[emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) | 3 | |
[Steffen\_Appel](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10477) | 2 | |
[Kaspars\_Zibarts](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11456) | 1 | |
[Alex-](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10384) | 1 | |
[Danny](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/687) | 1 | |
[Bob\_Zimmerman](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/27871) | 1 | |
[DH](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25118) | 1 | [View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/general-topics/timerange/one_month/page/1/tab/authors) Trending Discussions [Five Habits That Improved My Check Point Deployments](https://community.checkpoint.com/t5/General-Topics/Five-Habits-That-Improved-My-Check-Point-Deployments/td-p/279760) [Automatically Renew VPN Certificates](https://community.checkpoint.com/t5/General-Topics/Automatically-Renew-VPN-Certificates/td-p/279072) [Snapshot and /boot disk space full](https://community.checkpoint.com/t5/General-Topics/Snapshot-and-boot-disk-space-full/td-p/280183) Upcoming Events Sort by: - [All](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630#) - [Virtual](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630#) - [In-Person](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630#) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) Thu 30 Jul 2026 @ 11:30 AM (CDT) [CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) [Virtual](https://community.checkpoint.com/labels/Virtual) Thu 30 Jul 2026 @ 10:00 AM (PDT) [AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411) [In-Person](https://community.checkpoint.com/labels/In-Person) Tue 11 Aug 2026 @ 11:30 AM (EDT) [New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 13 Aug 2026 @ 11:30 AM (EDT) [Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 08:30 AM (COT) [Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 06:00 PM (COT) [Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 27 Aug 2026 @ 09:00 AM (CEST) [Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914) [In-Person](https://community.checkpoint.com/labels/In-Person) Wed 21 Oct 2026 @ 09:00 AM (BST) [AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505) [CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events) [Top](https://community.checkpoint.com/t5/General-Topics/HTTPS-Inspection-SNI-and-CN-in-generated-certificate/m-p/36630) About CheckMates - [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage) - [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage) Learn Check Point - [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0) - [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia) - [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix) Advanced Learning - [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm) - [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge) - [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=) - [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification) Resources - [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox) - [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub) - [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog) - [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live) Non-English Discussions - [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish) - [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais) - [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese) - [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese) - [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian) - [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan) YOU DESERVE THE BEST SECURITY We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates) [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/) ©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/) Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.