## Inbound HTTPS Inspection - Custom client certificate required

Hi Everyone!

We have a use case where we need to deploy inbound HTTPS Inspection to a specific web service that uses a non standard port.

Gateways and management are both running R80.40.

Initially we are seeing a Bypass with the following error "Internal system error in HTTPS Inspection (Error Code: 2)"

One of the possible causes is that the root certificate is not trusted, however the customer is using the same cert in other inbound inspection rules without issues.

While troubleshooting we found that the backend application requires the client to send a specific certificate.

Since we are doing a Man-in-the-middle (MITM) for inspection it's obvious that the connection between the Gateway and the server will have the Check Point self signed certificate, not the one required by the application.

I know that this use case can be solved with an ADC such as F5, Netscaler, A10.

Questions:

\- Can we do it with Check Point? I didn't find a proper way of using specific client certificates (Not server certs) for specific connections within the admin guides or SKs.

\- Can "Internal system error in HTTPS Inspection (Error Code: 2)" be related to this issue? An HTTPS debug is not possible for the moment due to maintenance window requirements.

Thanks!

\_\_\_\_\_\_\_\_\_\_\_\_

https://www.linkedin.com/in/federicomeiners/

- Tags:
- [https inspection](https://community.checkpoint.com/t5/tag/https%20inspection/tg-p/board-id/general-topics)

- [inbound https inspection](https://community.checkpoint.com/t5/tag/inbound%20https%20inspection/tg-p/board-id/general-topics)

- [inspection](https://community.checkpoint.com/t5/tag/inspection/tg-p/board-id/general-topics)

- [r80.40](https://community.checkpoint.com/t5/tag/r80.40/tg-p/board-id/general-topics)

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/99707?t:ac=board-id/general-topics/message-id/19405/thread-id/19405&t:cp=kudos/contributions/tapletcontributionspage&ticket=VS_R8w6FqNiw_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

- [All forum topics](https://community.checkpoint.com/t5/General-Topics/bd-p/general-topics/page/218 "General Topics")
- [Previous Topic](https://community.checkpoint.com/t5/General-Topics/R81-HTTPS-Inspection/td-p/130134 "R81 HTTPS Inspection")
- [Next Topic](https://community.checkpoint.com/t5/General-Topics/Export-all-UUIDs-that-is-related-to-specific-Change-ID/td-p/131100 "Export all UUIDs that is related to specific Change ID")

1 Solution

Accepted Solutions

[\_Val\_](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/181)

Admin

‎2020-10-2107:06 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=19407)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713/highlight/true#M19407)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/19407/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/99713)

[Jump to solution](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

AFAIK, we do not have such functionality available. Try raising and RFE with your local Check Point team. Meanwhile, you will have to create a bypass rule for this application to work

[View solution in original post](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

[1\\
\\
\\
Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/19407/tab/all-users "Click here to see who gave kudos to this post.")

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/99713?t:ac=board-id/general-topics/message-id/19405/thread-id/19405&t:cp=kudos/contributions/tapletcontributionspage&ticket=VS_R8w6FqNiw_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

4 Replies

[\_Val\_](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/181)

Admin

‎2020-10-2107:06 AM

[Jump to solution](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

[FedericoMeiners](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/28479)

Advisor

‎2020-10-2109:25 AM

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=19417)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99731/highlight/true#M19417)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/19417/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/99731)

[In response to \_Val\_](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713/highlight/true#M19407)

[Jump to solution](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

Valeri,

Thanks for the quick response! Just wanted to be sure of my assumptions.

It would be nice feature however it's not the job of a NGFW 🙂

Will work on the RFE with my local SE.

Thanks!

Federico

\_\_\_\_\_\_\_\_\_\_\_\_

https://www.linkedin.com/in/federicomeiners/

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/99731?t:ac=board-id/general-topics/message-id/19405/thread-id/19405&t:cp=kudos/contributions/tapletcontributionspage&ticket=VS_R8w6FqNiw_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

[Martin\_Stolz](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/8615)

Participant

‎2021-10-0603:30 PM

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=23804)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/131194/highlight/true#M23804)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/23804/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/131194)

[In response to FedericoMeiners](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99731/highlight/true#M19417)

[Jump to solution](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

I know this thread is maybe already outdated,

but i'm very interested in case there was a response to the RFE.

I do have a similar requirement.

\\* HTTPS inbound inspection should be used to inspect traffic.

\\* Server requires certificate based client authentication

My quick check:

**Server tcpdump**:

\- Server Hello, Certificate, **Certificate Request**, Server Hello Done

**Server Application Log:**

- HTTPS client connection from host {FW-IP} failed due to the SSL error:

(sec.core-114) SSL connection error (peer did not return a certificate).

The behavior is, that this connection will time out.

Firewall **log doesn't show Error Code-2**

(what is in my experience mostly missing CA cert in list of Trusted CA or failed OCSP/CRL check)

Our competitor PA offers for such cases an interesting " **nonProxy / forwarding mode**".

As they have the private key and key exchange is RSA (not PFS),

then the firewall can simply copy and decrypt the https traffic for inspection. (PA is not MITM)

[SSL Inbound Inspection (paloaltonetworks.com)](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption-concepts/ssl-inbound-inspection)

Does Check Point support such a mode?

[@FedericoMeiners](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/28479): Did you raised an RFE?

Thanks,

Ciao Martin

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/131194?t:ac=board-id/general-topics/message-id/19405/thread-id/19405&t:cp=kudos/contributions/tapletcontributionspage&ticket=VS_R8w6FqNiw_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

[PhoneBoy](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7)

Admin

‎2021-10-0603:55 PM

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=23805)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/131196/highlight/true#M23805)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/23805/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/131196)

[In response to Martin\_Stolz](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/131194/highlight/true#M23804)

[Jump to solution](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99713#M19407)

I believe as part of our NDR offering we have something that can do this.

The feature is called Cooperative Inspection.

Note that NDR sensors run a different image and are managed differently from regular Check Point gateways.

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/131196?t:ac=board-id/general-topics/message-id/19405/thread-id/19405&t:cp=kudos/contributions/tapletcontributionspage&ticket=VS_R8w6FqNiw_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

Post Reply

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

| User | Count |
| --- | --- |
| <br>[israelfds95](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/93117) | 13 |
| <br>[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670) | 7 |
| <br>[simonemantovani](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/79070) | 5 |
| <br>[emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) | 3 |
| <br>[Steffen\_Appel](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10477) | 2 |
| <br>[Kaspars\_Zibarts](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11456) | 1 |
| <br>[Alex-](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10384) | 1 |
| <br>[Danny](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/687) | 1 |
| <br>[Bob\_Zimmerman](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/27871) | 1 |
| <br>[DH](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25118) | 1 |

[View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/general-topics/timerange/one_month/page/1/tab/authors)

Trending Discussions

[Five Habits That Improved My Check Point Deployments](https://community.checkpoint.com/t5/General-Topics/Five-Habits-That-Improved-My-Check-Point-Deployments/td-p/279760)

[Automatically Renew VPN Certificates](https://community.checkpoint.com/t5/General-Topics/Automatically-Renew-VPN-Certificates/td-p/279072)

[Snapshot and /boot disk space full](https://community.checkpoint.com/t5/General-Topics/Snapshot-and-boot-disk-space-full/td-p/280183)

Upcoming Events

Sort by:

- [All](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707#)
- [Virtual](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707#)
- [In-Person](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707#)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Tue 28 Jul 2026 @ 11:00 AM (EDT)

[Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 12:00 PM (SGT)

[The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 02:00 PM (IDT)

[The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 03:00 PM (CEST)

[The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 11:00 AM (EDT)

[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)

Thu 30 Jul 2026 @ 11:30 AM (CDT)

[CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Tue 28 Jul 2026 @ 11:00 AM (EDT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 12:00 PM (SGT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 02:00 PM (IDT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 03:00 PM (CEST)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 11:00 AM (EDT)

[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Thu 30 Jul 2026 @ 10:00 AM (PDT)

[AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Tue 11 Aug 2026 @ 11:30 AM (EDT)

[New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 13 Aug 2026 @ 11:30 AM (EDT)

[Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 20 Aug 2026 @ 08:30 AM (COT)

[Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 20 Aug 2026 @ 06:00 PM (COT)

[Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 27 Aug 2026 @ 09:00 AM (CEST)

[Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Wed 21 Oct 2026 @ 09:00 AM (BST)

[AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505)

[CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events)

[Top](https://community.checkpoint.com/t5/General-Topics/Inbound-HTTPS-Inspection-Custom-client-certificate-required/m-p/99707)

About CheckMates

- [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage)
- [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage)

Learn Check Point

- [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0)
- [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia)
- [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix)

Advanced Learning

- [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm)
- [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge)
- [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=)
- [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification)

Resources

- [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox)
- [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub)
- [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog)
- [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live)

Non-English Discussions

- [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish)
- [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais)
- [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese)
- [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese)
- [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian)
- [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan)

YOU DESERVE THE BEST SECURITY

We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates)  [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/)

©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/)

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.