> Source: [sk1000220](https://support.checkpoint.com/results/sk/sk1000220)

# sk1000220 - Identity Broker Subscriber disconnects after certificate renewal

| Property | Value |
|----------|-------|
| Solution ID | sk1000220 |
| Date Created | 2026-10-01 |
| Last Modified | 2026-10-01 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * After a certificate update on a subscriber Security Gateway, the firewall no longer synchronizes with the Policy Decision Point (PDP) Broker publisher systems.
* The Identity Broker status shows peer certificate validation failures and disconnected broker relationships.
* On the affected broker or subscriber, the following commands show that the peer is disconnected:

#pdp br st -e shows
"Peer certificate verification fails".

* PDP Broker debug logs show Transport Layer Security (TLS) certificate validation failures:

Peer
certificate cannot be authenticated with given CA certificates

curl
error code:60

unable
to get local issuer certificate

* Running the certificate fetch command for the subscriber shows this warning:

# BrokerCertFetcher x.x.x.x

Root
certificate in chain is not self signed - this might not be the CA

* The broker Certificate Authority (CA) certificate file for the subscriber exists, but it contains the subscriber end-entity certificate instead of a valid CA certificate:

$FWDIR/nac/broker_ca_certs/x.x.x.x.pem

## Cause

The subscriber Security Gateway presented an incomplete
certificate chain during the TLS handshake.

The subscriber presented only its own gateway certificate.
It did not present the required issuing CA chain, which includes the
intermediate CA certificate and the root CA certificate.

Because the full CA chain was missing, the PDP Broker
publisher could not fetch and store a valid CA certificate for the subscriber.
Instead, the certificate fetch process saved the subscriber end-entity
certificate in the broker CA certificate directory:

$FWDIR/nac/broker_ca_certs/x.x.x.x.pem

As a result, the PDP Broker publisher did not have the
issuing CA certificate that it needed to validate the subscriber certificate.
The TLS validation failed with an unknown local issuer condition. This caused curl
error code:60 and the Identity Broker connection changed to Peer certificate
verification failed

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content