> Source: [sk101049](https://support.checkpoint.com/results/sk/sk101049) # sk101049 - Expired certificates cannot be deleted from the Management Database | Property | Value | |----------|-------| | Solution ID | sk101049 | | Date Created | 2014-05-25 | | Last Modified | 2022-01-04 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.10, R82.20, R81.20, R82, R82.20 | ## Symptoms - * Expired certificates cannot be deleted in Internal CA Management Tool: 1. Connect to the command line on Management Server (over SSH, or console). 2. Log in to Expert mode. 3. Enable Internal CA Management Tool on the Security Management Server / Domain Management Server (refer to [sk39915](http://supportcontent.checkpoint.com/solutions?id=sk39915)): `[Expert@HostName]# cpca_client set_mgmt_tool on [-no_ssl]` 4. Connect to Internal CA Management Tool with a web browser. 5. In the left pane, click on "`Manage CRLs`." 6. Click "`Clean the CA's Database and CRLs from expired certificates`" - confirm, when prompted. 7. Connect to the command line on Management Server (over SSH, or console). 8. Log in to Expert mode. 9. Check the list of expired certificates: `[Expert@HostName]# cpca_client lscert -stat Expired` The expired certificates are **still listed**, even though they were supposed to be deleted from the database. * Expired certificates do not appear in the Management Database: * Internal CA Management Tool does not show any expired certificates (click on '`Manage Certificates`' - in '`Status`' field, select '`Expired`' - click on '`Search`' button) * Output of '`cpca_client lscert -stat Expired`' shows: `Operation succeeded. rc=0.` ` 0 certs found.` * ICA Management Tool ([sk39915](http://supportcontent.checkpoint.com/solutions?id=sk39915)) shows that several certificates that should have expired, still appear as '`Valid`.' * '`cpca_client lscert`' command fails with error "`Operation failed. rc=-1.`" * Running the '`cpca_client lscert `' command under debug ('`fw debug cpca on TDERROR_ALL_ALL=5`') shows: ``` fwasync_connbuf_realloc: Connection buffer overflow. Cannot allocate N bytes of memory. Limit is 1048576. fwasync_conn_send: fwasync_connbuf_realloc() failed. ``` ## Cause Certificate that are Revoked and Expired will not show when filtering with Expired. Filtering with Expired will not show certificate that are also Revoked. ## Solution This problem was fixed. The fix is included starting from: * [Check Point R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=skXXX) * [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152&partition=Basic&product=Endpoint) - Take 237 Check Point recommends to always upgrade to the most recent version ([Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)).
### **Configuration Instructions for R80.40 and higher (and Jumbo Hotfix Accumulators that contain this fix):** Show / Hide this section **Important Note** - In Management High Availability environment, this procedure must be performed on all Management Servers. 1. Connect to the command line on the Management Server. 2. Log in to the Expert mode. 3. Set the value of the environment variable **`FWASYNC_MAXBUF`** to **`8388608`** in **all** Check Point shell scripts that define environment variables: * Show / Hide instructions for a Security Management Server, which runs on Gaia OS 1. In the **`$CPDIR/tmp/.CPprofile.sh`** script: Add this line: **`FWASYNC_MAXBUF=8388608 ; export FWASYNC_MAXBUF`** Under this line `INFODIR=/opt/CPinfo-10 ; export INFODIR` Note: The line "**`INFODIR=/opt/CPinfo-10 ; export INFODIR`** " may not exist exactly as written. In versions R80 and higher, the line appears like this: "`_cpprof_add INFODIR "/opt/CPinfo-10" -1 0`". 2. In the **`$CPDIR/tmp/.CPprofile.csh`** script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Under this line: `setenv INFODIR "/opt/CPinfo-10"` **Note:** To unset this variable, remove it from the above shell scripts.
* Show / Hide instructions for a Multi-Domain Security Management Server, which runs on Gaia OS 1. Go to the context of MDS: ``` [Expert@HostName]# mdsenv [Expert@HostName]# mcd ``` 2. In the **`$MDSDIR/scripts/mdsstart_customer`** script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Above the last line: `exit 0` 3. In the **`$CPDIR/tmp/.CPprofile.sh`** (`/var/opt/CPshrd-R/tmp/.CPprofile.sh`) script: Add this line: **`FWASYNC_MAXBUF=8388608 ; export FWASYNC_MAXBUF`** Under this line `INFODIR=/opt/CPinfo-10 ; export INFODIR` 4. In the **`$CPDIR/tmp/.CPprofile.csh`** (`/var/opt/CPshrd-R/tmp/.CPprofile.csh`) script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Under this line: `setenv INFODIR "/opt/CPinfo-10"` **Note:** To unset this variable, remove it from the above shell scripts.
4. Reboot the Management Server. 5. Make sure that the new buffer size value was set: **`[Expert@HostName]# echo $FWASYNC_MAXBUF`**



### Instructions for R80.30 and lower: Show / Hide this section [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Management Server involved in the case. [](http://www.checkpoint.com/support-services/contact-support/index.html) **Configuration instructions:** **Important Note** - In Management High Availability environment, this procedure must be performed on all Management Servers. 1. Install the hotfix on the ***Security Management Server / Multi-Domain Security Management Server***. Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597). 2. Set the value of environment variable **`FWASYNC_MAXBUF`** to **`8388608`** in **all** Check Point shell scripts that define environment variables for the given operating system: * Show / Hide instructions for a Security Management Server, which runs on Gaia / SecurePlatform / Linux / IPSO OS 1. In the **`$CPDIR/tmp/.CPprofile.sh`** script: Add this line: **`FWASYNC_MAXBUF=8388608 ; export FWASYNC_MAXBUF`** Under this line `INFODIR=/opt/CPinfo-10 ; export INFODIR` Note: The line "**`INFODIR=/opt/CPinfo-10 ; export INFODIR`** " may not exist exactly as written. In versions R80 and higher, the line appears like this: "`_cpprof_add INFODIR "/opt/CPinfo-10" -1 0`". 2. In the **`$CPDIR/tmp/.CPprofile.csh`** script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Under this line: `setenv INFODIR "/opt/CPinfo-10"` **Note:** To unset this variable, remove it from the above shell scripts.
* Show / Hide instructions for a Security Management Server, which runs on Windows OS 1. Start - Run... - **`"%WINDIR%\system32\rundll32.exe" sysdm.cpl,EditEnvironmentVariables`** - OK 2. Under '`System Variables`' - click on '`New...`' * name: **`FWASYNC_MAXBUF`** * value: **`8388608`** * and click '`OK`'

3. Click on '`OK`'. **Note:** To unset this variable, under '`System Variables`' click on this variable and click on '`Delete`'.
* Show / Hide instructions for a Multi-Domain Security Management Server, which runs on Gaia / SecurePlatform / Linux OS 1. Go to the context of MDS: ``` [Expert@HostName]# mdsenv [Expert@HostName]# mcd ``` 2. In the **`$MDSDIR/scripts/mdsstart_customer`** script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Above the last line: `exit 0` 3. In the **`$CPDIR/tmp/.CPprofile.sh`** (`/var/opt/CPshrd-R/tmp/.CPprofile.sh`) script: Add this line: **`FWASYNC_MAXBUF=8388608 ; export FWASYNC_MAXBUF`** Under this line `INFODIR=/opt/CPinfo-10 ; export INFODIR` 4. In the **`$CPDIR/tmp/.CPprofile.csh`** (`/var/opt/CPshrd-R/tmp/.CPprofile.csh`) script: Add this line: **`setenv FWASYNC_MAXBUF 8388608`** Under this line: `setenv INFODIR "/opt/CPinfo-10"` **Note:** To unset this variable, remove it from the above shell scripts.
3. Reboot the Management Server. 4. Make sure the new buffer size value was set: * On Gaia / SecurePlatform / Linux / IPSO OS: **`[Expert@HostName]# echo $FWASYNC_MAXBUF`** * On Windows OS: **`C:\> set | findstr FWASYNC_MAXBUF`** *** ** * ** *** ### **To clean the expired certificates from the management database:** 1. Connect to the [ICA Management Tool](http://supportcontent.checkpoint.com/solutions?id=sk39915). 2. Go to "`Manage CRLs`". 3. Click "`Clean the CA's database and CRL's from expired certificates`". *** ** * ** *** **If after cleaning the expired certificates from the management database, a warning appears that the deleted VPN certificate is about to expire, then follow these steps to remove the problematic VPN certificate from the involved Security Gateway / Cluster.** Show / Hide this section 1. Connect with SmartConsole (R80 and higher) / SmartDashboard (R77.30 and lower) to the Security Management Server / Domain Management Server. 2. Go to the main menu / '`File`' menu - click '`Database Revision Control...`' - create a revision snapshot. 3. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.). 4. Connect with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to the Security Management Server / Domain Management Server. 5. In the upper left pane, go to '**`Table`** ' - '**`Network Objects`** ' - '**`network_objects`** '. 6. In the upper right pane, select the relevant Security Gateway / Cluster object. 7. Press CTRL+F (or go to '`Search`' menu - '`Find`') - paste **`certificates`** - click on '`Find Next`'. 8. In the lower pane: 1. Locate the '**`certificates`** ' container. 2. Inside this container, locate the problematic certificate. To be sure, look at the value of "*dn* " - after the "*CN=* " you will see the name of the Security Gateway / Cluster object. 3. Right-click on the name of the certificate - select '`Delete`'. Note: There will be *no* prompt to confirm the deletion.
*Example* : [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk101049/sk101049_delete_certificate.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk101049/sk101049_delete_certificate.png "Click the image to see it in full size in a new tab/window") 9. Save the changes: go to '`File`' menu - click on '`Save All`'. 10. Close the GuiDBedit Tool. 11. Connect with SmartConsole / SmartDashboard to the Security Management Server / Domain Management Server. 12. Install the policy onto the relevant Security Gateway / Cluster object. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content