> Source: [sk1000165](https://support.checkpoint.com/results/sk/sk1000165)

# sk1000165 - Site-to-Site VPN Tunnels Fail During IKE Phase 1 Due to VPN Certificate Revocation

| Property | Value |
|----------|-------|
| Solution ID | sk1000165 |
| Date Created | 2026-09-17 |
| Last Modified | 2026-09-22 |
| Technical Level | General |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.20, R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Internal Site-to-Site Virtual Private Network (VPN) tunnels between Check Point Firewalls (**Security Gateways** in R82.10 and lower) remain down in a VPN community.
* Traffic is interrupted for Site-to-Site VPN connections associated with the affected Firewall or Cluster.
* VPN logs in SmartConsole show:  

  ```text
  Main Mode Sent Notification to Peer: no proposal chosen
  ```

* Additional log messages include:   

  ```text
  proposalListFromIkeProps: transL->translst doesn't contain elements
  MMProcess1: ERROR: Cannot build a proposal for GW
  extended_log_info_build_reason_from_list: list is empty
  ```

## Cause

The outage occurs when the VPN certificate used for certificate-based Site-to-Site VPN authentication is revoked on the affected Check Point Firewall (**Security Gateway** in R82.10 and lower). During IKE Phase 1, peers authenticate each other using their VPN certificates. If a VPN certificate is revoked, certificate-based authentication fails and the VPN tunnel cannot be established.

Support investigation identified the following sequence of events:

1. An administrator selects **Renew** for a VPN certificate on a Check Point Firewall or Cluster in SmartConsole.
2. The administrator then cancels or closes the Check Point Firewall or Cluster object before saving the change.
3. The certificate renewal action is processed immediately. As the object is closed before the change is completed, the new certificate becomes orphaned.
4. The existing VPN certificate moves to a **Renewed** state and is automatically revoked after the **7-day** renewal grace period expires.

This condition can occur without a clear publish event or pending change in the SmartConsole audit logs. As a result, the audit trail might not always show an obvious certificate change.

To confirm this condition, review the Check Point Certificate Authority (CPCA) log on the Security Management Server. The relevant log file is:

```text
$FWDIR/log/cpca.elg
```

Verify that the log shows revocation of the original VPN certificate.

## Solution

1. **Renew the VPN certificate on the affected Check Point Firewall or Cluster:**
   1. Open SmartConsole to connect to the Security Management Server.
   2. Open the affected Firewall or Cluster object.
   3. Go to the **IPsec VPN** certificate configuration page.
   4. Select the VPN certificate used for Site-to-Site VPN authentication.
   5. Click **Renew**.
   6. Click **OK** to save and close the object.
2. **Publish and Install Policy:**
   1. In SmartConsole, click **Publish**.
   2. Install the Access Control policy on the following devices:
      * The affected Check Point Firewall or cluster.
      * All relevant VPN peer gateways or clusters in the mesh VPN community.
   3. Verify that policy installation completes successfully on all target firewalls and VPN peers.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content