Regenerate the Internal CA Without Breaking SIC
The internal CA certificate expires after 5 years, meaning that if you don’t catch this in time you won’t be able to log into the dashboard or the web UI. You can of course reset SIC on the command line using cpconfig but you will have to re-establish SIC with all your gateways which may be a lot of bother – besides that, any site-to-site or client certificate-based VPNs will also break. This article describes how to regenerate the internal CA without breaking SIC.
This is done on the command line and once completed (a matter of 5 minutes or less) then you will be able to log back in with SmartDashboard and push policies to all your managed gateways; all your certificate-based VPN operations will, quite happily, be none the wiser.
This example is from a R75.20 installation but is common to all up to R77.xx.
On the management station:
Enter expert mode and issue the following commands:
- Find the path to your existing (expired) certificate:
[Expert@mgmt]# find / -name "sic_cert.p12" /var/opt/CPshrd-R75.20/conf/sic_cert.p12 [Expert@mgmt]
- Revoke the certificate:
[Expert@mgmt]# cpca_client revoke_cert -n “CN=cp_mgmt”
- Create a new certificate based on the old one
cpca_client create_cert -n “CN=cp_mgmt” -f /var/opt/CPshrd-R75.20/conf/sic_cert.p12
- Restart your Checkpoint services
[Expert@mgmt]# cpstop [Expert@mgmt]# cpstart
You should now be able to log in with SmartDashboard and everything else which relies on SIC!