# Certificate and CRL validation fails from March 1, 2026

## Product

- Maestro HyperScale Firewall, Security Gateways, Security Management, Spark Firewall, VSNext, VSX (Traditional)

## Version

- R82, R82.10

## OSGaia, Gaia Embedded

## Last Modified

- 2026-04-19

## Symptoms

- Starting March 1st, 2026, newly created certificates and newly generated CRL (Certificate Revocation List) may fail validation. The issue may manifest as one or more of the following:

- **VPN**
  - Site to Site VPN tunnels based on X509 certificate may fail on re-authentication.
  - Remote Access VPN certificate-based authentication failures.
- **Maestro Orchestrator**
  - Synchronization between Maestro Orchestrators fails.
  - Applying the configuration changes in Gaia Portal or Gaia Clish fails with the _"Orchestrator 1_2 has Rest Server issues"_ message.
  - Configuring the authentication with a remote Orchestrator fails with errors:

_"Orchestrator is known but cannot securely communicate._

_Orchestrator can SSH but cannot REST."_
  - The HCP test "Orchestrators REST server" fails on the Orchestrators with _"Client return code: 132"._
- **Management and Provisioning**
  - Failure to establish SIC (Secure Internal Communication) between Management and Gateway when creating a new gateway or Virtual System.
  - Failure to provision new Gateways in CloudGuard Network autoscaling VMSS.
  - Upgrade of Multi-Domain Log Server (MLM) and Global SmartEvent may fail.
- **CloudGuard Network Security**
  - In addition to the symptoms listed, CloudGuard Network Security may also experience these issues on:
    - AWS, Azure, GCP, and OCI public clouds
    - Cloud Management Extension (CME) on the Security Management
    - CloudGuard Controller and CloudGuard Central License

**Note:** Only Gateways running R82.10 Build 991001970 or R82 Build 991002015 or earlier are affected.
- **Check Point Cloud Updates and Services**
  - Failure to download IPS, Anti-Virus, and URL Filtering updates, and use of Threat Emulation services for up to 24 hours.
  - Intermittent errors when connecting to Check Point update services.
- **Smart-1 Cloud connectivity**
  - Potential failure to establish connection with Smart-1 Cloud management.
  - Risk of losing connection to Smart-1 Cloud management.
- **HTTPS Inspection**
  - Failure to connect to sites with certificates created in the past 24 hours.
- **Third-Party Integrations**
  - Certificate-based integrations with third-party products may fail.

**Note:** VPN traffic on environments with R82 Management Server and R81.20 Security Gateways is not impacted.

## Cause

In **R82 and R82.10**, there is an error in the date calculation logic used during validation of:

- X.509 certificates
- Certificate Revocation Lists (CRLs)

Starting **March 1, 2026**, newly generated certificates and CRLs are evaluated as **not yet valid** because of incorrect calculation of the _Not Before_ timestamp.

As a result:

- Certificates and CRLs are considered valid only after up to 24 hours.
- Any operation requiring immediate certificate or CRL validation fails during this period.

**This issue is not related to the system clock, timezone, or NTP configuration.**

## Solution

We're here for you

Please log in / sign in to view solution

## Article Properties

- Access Level: Advanced
- Status: Approved
- Date Created: 2026-03-01
- Last Modified: 2026-04-19