> Source: [sk1000066](https://support.checkpoint.com/results/sk/sk1000066)

# sk1000066 - ICA certificate is not automatically synchronized to the Standby CMA in Multi-Domain Server High Availability

| Property | Value |
|----------|-------|
| Solution ID | sk1000066 |
| Date Created | 2026-08-26 |
| Last Modified | 2026-09-03 |
| Technical Level | Advanced |
| Products | Multi-Domain Security Management Server |
| Versions | R82.10, R81.20, R82, R82.20 |
| OS | Gaia |
| Platform | Smart-1 |

## Symptoms

- On a Multi-Domain Security Management Server (MDS) High Availability deployment:

* The Internal Certificate Authority (ICA) is automatically renewed on the Active/Primary CMA, but is not renewed on the Standby/Secondary CMA.
* The ICA expiration dates differ between the Active and Standby CMAs.
* This can occur even when the environment runs a release/Jumbo Hotfix level that supports automatic ICA renewal (per [sk158096](https://support.checkpoint.com/results/sk/sk158096)).

Example:

<br />

`[Expert@Primary_MDS:0]# mdsenv <active_CMA>`  
`
[Expert@Primary_MDS:0]# cpopenssl pkcs12 -in $FWDIR/conf/InternalCA.p12 -nokeys -nomacver -passin pass: 2>/dev/null | cpopenssl x509 -noout -enddate`  
`notAfter=Jan 19 03:14:07 2038 GMT`  

<br />

<br />

`[Expert@Standby_MDS:0]# mdsenv <standby_CMA>`  
`
[Expert@Standby_MDS:0]# cpopenssl pkcs12 -in $FWDIR/conf/InternalCA.p12 -nokeys -nomacver -passin pass: 2>/dev/null | cpopenssl x509 -noout -enddate`  
`notAfter=May 26 11:01:36 2027 GMT`  

<br />

## Cause

The ICA can be renewed on the Active CMA; however, the renewed `InternalCA.p12` file may not be copied automatically to the corresponding Standby CMA. The limitation is related to the inability of a process running in CMA context to communicate directly with the CMA hosted on the peer MDS.

As a result, the ICA certificate on the Standby CMA can retain its previous expiration date.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content