Background

An important part of HTTPS Inspection support is the validation of the server's certificates from the signing Certificate Authority (CA).

Note - When you enable the "Categorize HTTPS sites" feature, the Trusted CA list is also used.

A Security Gateway with enabled HTTPS Inspection has a built-in predefined list of Trusted CAs, based on the Microsoft updated TrustedCA list.

Updates are released based on changes in the recommended CA list.

This article describes how to:

Perform a manual update of Trusted CAs
Configure a Management Server to check if updates to Trusted CAs are necessary

To configure a Management Server to update the Trusted CAs automatically, follow sk173629 - How to update Trusted CAs automatically.

Performing a manual update of Trusted CAs on a Management Server

Download the Trusted CAs package (ZIP archive).

Software Subscription or Active Support plan is required to download this package.

Upload the Trusted CAs package to the Management Server.

On a Management Server versions R82 and higher:

Show / Hide this section

From the left navigation panel, click Security Policies.

In the top panel, click the HTTPS Inspection section.

In the bottom panel HTTPS Inspection, click Trusted Certificates.

In the left panel, click the Trusted CAs Package page.

In the top right section Update Trusted CAs Package, select the option Manually.

Perform the applicable manual update:

To update the package from the Check Point cloud, click the Update now button

To import the offline package:

On the right side of the Update now button, click the downward arrow and click Import Trusted CAs Package.

Browse to the offline ZIP package and select it.

Click Open.

Click Close to close the Trusted Certificates window.

Install the Access Control Policy.

On a Management Server versions R80 - R81.20:

Show / Hide this section

Connect with SmartConsole to Security Management Server / Domain Management Server.

From the left navigation panel, click Manage & Setting.

Click Blades.

Below Configure HTTPs Inspection, click Configure in SmartDashboard.

Click the Trusted CAs section.

At the top, click Actions > select Update certificate list... > browse for and select the ZIP archive with certificates you downloaded in the previous step > click Open.

Save the changes and close SmartDashboard.

In SmartConsole, install the Access Control Policy on the Security Gateways.

On a Management Server versions R77.30 and lower:

Show / Hide this section

Connect with SmartDashboard to Security Management Server / Domain Management Server.

Go to the Application & URL Filtering tab.

Expand the Advanced section.

Expand the HTTPS Inspection section.

Click on the Trusted CAs section.

At the top, click Actions button > select Update certificate list... > browse for and selected the ZIP archive with certificates you downloaded in the previous step > click Open.

Install the policy on the Security Gateways.

Enabling automatic update checks for Trusted CAs on a Management Server

On a Management Server versions R82 and higher:

Show / Hide this section

From the left navigation panel, click Security Policies.

In the top panel, click the HTTPS Inspection section.

In the bottom panel HTTPS Inspection, click Trusted Certificates.

In the left panel, click the Trusted CAs Package page.

In the top right section Update Trusted CAs Package, select the option Automatically.

Click Close to close the Trusted Certificates window.

Install the Access Control Policy.

On a Management Server versions R80 - R81.20:

Show / Hide this section

Connect with SmartConsole to Security Management Server / Domain Management Server.

From the left navigation panel, click Manage & Setting.

Click Blades.

Below Configure HTTPs Inspection, click Configure in SmartDashboard.

Click the Trusted CAs section.

At the bottom of this page, in the Automatic Updates section, select:

In versions R81.20 and R81.10:

Download updates automatically and notify when an update file is available for installation

or

Download and install updates automatically

In versions R81 / R80.40 / R80.30 / R80.20 / R80.10 / R80:

Notify when a Trusted CA and Blacklist update file is available for installation

Important - This only enables the automatic check for updated Trusted CAs. You must install the update manually.

If there is an available update, then this message appears in the Automatic Updates section with the button Install Now:

A Trusted CA and Blacklist update has been downloaded

Example from SmartDashboard R81:

Save the changes (diskette icon on the top toolbar) and close SmartDashboard.

In SmartConsole, install the Access Control Policy on the Security Gateways.

On a Management Server versions R77.30 and lower:

Show / Hide this section

Connect with SmartDashboard to the Security Management Server / Domain Management Server.

Go to the Application & URL Filtering tab.

Expand the Advanced section.

Expand the HTTPS Inspection section.

Click the Trusted CAs section.

At the bottom of this page, in the Automatic Updates section, select Notify when a Trusted CA and Blacklist update file is available for installation.

If there is an available update, then this message appears in the Automatic Updates section with the button Install Now:

A Trusted CA and Blacklist update has been downloaded

Example from SmartDashboard R77.30:

Click Install now.

Install policy on the Security Gateways.

Related Solutions:

sk173629 - How to update Trusted CAs automatically