> Source: [sk103840](https://support.checkpoint.com/results/sk/sk103840) # sk103840 - SHA-1 and SHA-256 certificates in Check Point Internal CA (ICA) | Property | Value | |----------|-------| | Solution ID | sk103840 | | Date Created | 2014-12-22 | | Last Modified | 2022-12-22 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 | ## Solution Background ---------- This article outlines Check Point versions that support SHA-256 certificates for SIC and for VPN. In R77.X and lower versions, by default, the Internal CA (ICA) issues certificates based on the SHA-1 algorithm. In R80.xx, by default, the SHA-256 signature algorithm signs the Internal Certificate Authority (ICA). Certificates issued by the ICA inherit the same signature algorithm as the ICA certificate. For example, as long as the signature algorithm of the ICA certificate is SHA-1, all certificates issued by it have the SHA-1 signature algorithm. Even when SHA-256 signs the recreated ICA root certificate, old certificates issued by the old ICA root certificate stay with the SHA-1 signature algorithm. Recreate old certificates if the signature algorithm of the ICA certificate is SHA-256 or higher. The same signature algorithm signs them. How to Check the Signature Algorithm of ICA Certificates -------------------------------------------------------- Show / Hide this section To see the hash algorithm of an ICA certificate: * On the Security Management Server, run this command in the Expert mode: `cpopenssl pkcs12 -in $FWDIR/conf/InternalCA.p12 -nokeys -nomacver -passin pass: | cpopenssl x509 -noout -text | grep "Signature Algorithm" ` * On the Multi-Domain Security Management Server, run these commands in the Expert mode: * `mdsenv ` * `cpopenssl pkcs12 -in $FWDIR/conf/InternalCA.p12 -nokeys -nomacver -passin pass: | cpopenssl x509 -noout -text | grep "Signature Algorithm"` If the hash algorithm is SHA-256, the output is: `Signature Algorithm: sha256WithRSAEncryption` If the signature algorithm is SHA-1, refer to [sk158096 - How to renew an Internal Certificate Authority (ICA) certificate](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk158096). How to Check the Signature Algorithm of SIC Certificates -------------------------------------------------------- Show / Hide this section To see the hash algorithm of a SIC certificate: * On the Security Management Server, run this command in the Expert mode: `cpopenssl pkcs12 -in $CPDIR/conf/sic_cert.p12 -nokeys -nomacver -passin pass: | cpopenssl x509 -noout -text | grep "Signature Algorithm"` * On the Multi-Domain Security Management Server, run these commands in the Expert mode: * `mdsenv ` * `cpopenssl pkcs12 -in $CPDIR/conf/sic_cert.p12 -nokeys -nomacver -passin pass: | cpopenssl x509 -noout -text | grep "Signature Algorithm"`
> If the hash algorithm is SHA-256, the output is: > `Signature Algorithm: sha256WithRSAEncryption` > > To learn more about Secure Internal Communication (SIC), refer to the [Quantum Security Management R81.10 Administration Guide](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuide/Topics-SECMG/Welcome.htm) (chapter "Managing Gateways", section "Secure Internal Communication") How to Renew IKE Certificates with the SHA-256 Signature Algorithm ------------------------------------------------------------------ Show / Hide this section 1. Make sure the ICA certificate signature algorithm is SHA-256 or higher. Refer to the section "How to check the Signature algorithm of ICA certificate?" above. 2. Renew IKE certificates, follow the procedure in [sk31539 - Security Management Server warns about expiring Security Gateway certificates during policy installation](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk31539) **Note**: It is not necessary to recreate the VPN Site on Remote Access Clients because the Security Gateway's DN does not change. How to Renew SIC Certificates with the SHA-256 Signature Algorithm ------------------------------------------------------------------ Show / Hide this section 1. Make sure the ICA certificate signature algorithm is SHA-256 or higher. Refer to the section "How to check the Signature algorithm of ICA certificate?" above. 2. Renew SIC certificates, refer to [sk43783 - How to renew SIC certificate for Security Management Server / Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk43783). **Related Solutions** : * [sk103839: Check Point update and online services migration to SHA-256 based certificates](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103839) * [sk63026: OPSEC SDK](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk63026) **Notes** : * In R80.xx environments, it is not supported for a Check Point Security Management Server that functions as the Log Server to be the OPSEC Server with vendors that cannot support SHA-256. Refer to [sk109618 - Cannot establish SIC with the 3rd party vendor after creating a new OPSEC Application](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109618). --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content