After installing specific Takes of the Jumbo Hotfix Accumulators for R80.40 / R81 / R81.10 / R81.20 on a Security Gateway, Certificate Validation for Site to Site VPN and Remote Access VPN stopped working

Product: Capsule Connect, Capsule VPN, Endpoint Security - Remote Access VPN, IPSec VPN, Mobile Access / SSL VPN, Remote Access VPN
Version: R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82
OS: Gaia
Last Modified: 2026-04-27

Symptoms

• After installing specific Takes of Jumbo Hotfix Accumulators for R80.40 / R81 / R81.10 / R81.20 on a Security Gateway / Cluster, Certificate Validation for Site to Site VPN and Remote Access VPN stopped working.

• Turning off CRL Checking from the trusted CA object resolves the issue.

• SmartConsole logs may show failed login attempts with this description:

  OCSP: could not connect to server.
  Make sure the server is up and running.CN=example.test.com
  

• This issue is observed in Site to Site VPN, Mobile Access Portal, Endpoint Security VPN, Capsule VPN, Capsule Connect, Capsule Workspace.

Cause

Starting with these Jumbo Hotfix Accumulator Takes (fix PRHF-24483), the Security Gateway uses OCSP as the default revocation validation method:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 8
• Jumbo Hotfix Accumulator for R81.10 starting from Take 38
• Jumbo Hotfix Accumulator for R81 starting from Take 60
• Jumbo Hotfix Accumulator for R80.40 starting from Take 158

If the Security Gateway cannot communicate with the OCSP server (cannot reach it, the server does not respond, OCSP is disabled on the server, and so on), then the certificate-based connection to the Security Gateway fails.

Solution

We're here for you

Please log in / sign in to view solution

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.