Background Information:

The general recommendation across the globe is to move to TLS v1.2:

• SSLv3 has become insecure and deprecated and the last several attacks (POODLE 2, Freak, Logjam) were directed at TLS.
• The Payment Card Industry Security Standards Council (PCI DSS / PCI SSC) set the date for mandatory support of TLS v1.2 to 30 June 2016.
• PCI DSS set the date for transition to exclusive use of TLS v1.2 to 30 June 2018.
• US-CERT recommends to move to TLS v1.1 or higher.

 

Check Point adds TLS v1.2 support for all the products, by dates specified below.

Most of Check Point products already support TLS v1.2, except for the products listed in the table below.

These products will be updated according to the table below.

Enter the string to filter this table:

Check Point Product	OS / Appliances	Check Point Software Version	Time Line (1)
Remote Access VPN Clients / Endpoint Security Clients	Windows 7, Windows 8, Windows 8.1, Windows 10	Since E80.62 for Windows	Dec 2015
	Mac OS X	Since E80.62 for Mac OS X	Feb 2016
	Windows XP, Windows Vista	Not Planned	Not Planned
Endpoint Security Management Server	Gaia, Windows	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
VPN Plugin for PC and Windows phone	Windows 8.1	Windows update	No ETA
Capsule VPN for PC and Windows phone	Windows 10	New application version in Microsoft store	July 2016
SSL Network Extender (SNX)	Windows, Mac OS X, Linux	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
ICA Management Portal / Management Portal	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since R80.10	May 2017
Gaia Portal	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since R80.10	May 2017
Platform Portal	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since R80.10	May 2017
Software Updates	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since R80.10	May 2017
Mobile Access Blade	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since Security Gateway R80.10	May 2017
Mobile Access Reverse Proxy (refer to sk110348)	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
Identity Agent	Windows 8.1, Windows 10	TLS v1.2 is already supported	-
	Windows Vista, Windows 7, Windows 8	Since Security Gateway R80.10	May 2017
	Windows XP	Not Planned	Not Planned
Secure Internal Communication (SIC)	All	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
SmartConsole	Windows	Contact Check Point Support to get an improved SmartConsole R77.30 that connects to Management Server with Take 266 of R77.30 Jumbo Hotfix (2) TLS1.2 Support for R80.10: R80.10 SmartConsole - starting from Build 042	July 2017
Mail Transfer Agent (MTA)	Gaia	Since Take 266 of R77.30 Jumbo Hotfix (2)	July 2017
		Since Security Gateway R80.10	May 2017
LOM card GUI	4800 appliances	Since LOM firmware v2.1.3	Jan 2016
	5000 appliances	Since LOM firmware v3.19	July 216
	12200, 12400, 12600 appliances	Since LOM firmware v2.1.3	Jan 2016
	13500, 13800 appliances	Since LOM firmware v2.30	July 2016
	15400, 15600 appliances	Since LOM firmware v3.19	July 2016
	21700, 21800 appliances	Since LOM firmware v2.30	July 2016
	23500, 23800 appliances	Since LOM firmware v3.19	July 2016
	Smart-1 25, 25B, 50, 150 appliances	Since LOM firmware v3.46	July 2016
	Smart-1 225, 3050, 3150 appliances	Since LOM firmware v2.30	July 2016
	TE250, TE1000, TE2000 appliances	Since LOM firmware v2.1.3	Jan 2016
SMB Appliances: 600 / 700 / 1100 / 1200R / 1400	Gaia Embedded	Since R77.20.40 for Gaia Embedded OS	Oct 2016
Private ThreatCloud	Gaia	Contact Check Point Support for more information.	August 2018
Threat Emulation	TEX100X, TEX250X, TEX1000x, TEX2000X	R77.30 JHF 317 R80.10 JHF 142 R80.20 GA	June 2018 August 2018  September 2018
DLP Exchange Agent	Windows Server		Q1 2020

Notes:

1. The schedule can be subject to modifications. For most up-to-date information, revisit this page or subscribe to RSS feed (at the top).

2. Support for TLS 1.2 was integrated since Take 266 of R77.30 Jumbo Hotfix.

   • For VSX Gateway, refer to sk112014 - "Cannot establish connection to SSL Network Extender gateway. Try to reconnect." error when connecting with SSL Network Extender to Mobile Access Portal on VSX Virtual System after installing the "TLS 1.2 Hotfix for R77.30".

   • Before installing Take 266 and higher of R77.30 Jumbo Hotfix, make sure to backup all the current httpd.conf files:
     [Expert@HostName:0]# find / -name httpd.conf -type f

     If any changes were made in the past in the httpd.conf files, then the new httpd.conf files should be edited manually (do NOT overwrite the new files with the backed up files).

   • If a connection from a SmartConsole computer to a Security Management Server / Domain Management Server must also be TLS 1.2, then an improved SmartConsole can be provided (otherwise, the communication will be TLS 1.0).

     This requires Take 266 and higher of R77.30 Jumbo Hotfix to be installed on the Security Management Server / Multi-Domain Security Management Server.