> Source: [sk1000204](https://support.checkpoint.com/results/sk/sk1000204)

# sk1000204 - Endpoint Security VPN Certificate Automatic Renewal Fails with Smart-1 Cloud

| Property | Value |
|----------|-------|
| Solution ID | sk1000204 |
| Date Created | 2026-09-29 |
| Last Modified | 2026-09-29 |
| Technical Level | General |
| Products | Smart-1 Cloud |
| Versions | Cloud |
| OS | Gaia |
| Platform | Smart-1 |

## Symptoms

- * Endpoint Security VPN client fails immediately or times out when the user selects **Renew** for a PKCS#12 (P12) authentication certificate.
* The VPN client displays this error:

```text
Renewal failed. Remote Access VPN could not establish connection with Internal CA.
Enter the server IP or server name and try again.
If this error occurs again, check your connectivity.
```

* The client log `TrGUI.log` shows that the renewal flow starts and that the client tries to send the renewal request to the registration service:

```text
http://X.X.X.X:18264/registration
```

* The renewal request starts, but the Transmission Control Protocol (TCP) connection to the Certificate Authority (CA) service on port `18264` does not complete. The connection later times out.
* Client logs show these errors:

```text
failed to renew certificate, rc = -4
Can't connect to the CA server: Http timeout.
```

* The issue occurs before the Virtual Private Network (VPN) tunnel is established.
* Remote Access VPN works when the user already has an imported P12 certificate.
* Creating a new P12 certificate in SmartConsole and importing it manually into the VPN client works.
* The issue started after migration from an on-premises Security Management Server to Smart-1 Cloud.
* After the migration, original certificate records were not visible in the user objects in SmartConsole.
* The gateway VPN certificate, also known as `defaultCert`, is valid.
* Secure Internal Communication (SIC) between the Security Gateway and Smart-1 Cloud works.
* Certificate creation from SmartConsole works.

## Cause

Because the S1C management has only a private IP address, and communication with it is possible only through the MaaS tunnel. External entities cannot communicate directly with the S1C through any other path.

During automatic VPN certificate renewal, the VPN client needs to send the renewal request to the ICA, which is hosted on the S1C itself. Since the S1C does not have a public IP address and is not directly reachable externally, this is a limitation for the automatic renewal process.

## Solution

Automatic P12 certificate renewal from the Endpoint Security VPN client is currently not supported with Smart-1 Cloud Security Management Server.

Use manual certificate renewal instead.

1. **Generate and export a new P12 certificate in SmartConsole:**

   * Connect to the Smart-1 Cloud management server with SmartConsole.
   * Go to **Users and Administrators**.
   * Open the relevant user object.
   * Go to the **Authentication** tab.
   * Generate or renew the user certificate.
   * Export the certificate as a P12 file.
   * Set a strong export password for the P12 file.
2. **Securely provide the P12 file to the user:**

   * Send the P12 file and its password through separate secure channels.
   * Do not send the P12 file and password in the same email or message.
   * Confirm that only the intended user can access the P12 file.
3. **Import the P12 certificate on the Endpoint Security VPN client:**

   * On the endpoint computer, open the Endpoint Security VPN client.
   * Open the VPN site or VPN client properties.
   * Go to the **Authentication** tab.
   * Select **Import Certificate**.
   * Browse to the exported P12 file.
   * Enter the P12 password.
   * Complete the import process.
4. **Verify the Remote Access VPN connection:**

   * Disconnect the Endpoint Security VPN client if it is connected.
   * Connect again with the newly imported P12 certificate.
   * Confirm that authentication succeeds.
   * Confirm that Remote Access VPN traffic works as expected.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content