> Source: [sk105246](https://support.checkpoint.com/results/sk/sk105246)

# sk105246 - Users are not able to connect to Mobile Access Portal with certificate issued by a third party CA 

| Property | Value |
|----------|-------|
| Solution ID | sk105246 |
| Date Created | 2015-03-16 |
| Last Modified | 2020-11-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Users are not able to connect to Mobile Access Portal with certificate issued by a third party CA (the Portal is totally non-responsive, or is simply blank).  
  User are able to connect only with certificate issued by the ICA.

* *$FWDIR/log/fwd.elg* shows that VPND daemon is restarted every 5 minutes:  

  `[FWD `*PID*` ...]@`*HostName* `[`*Date Time*`] fwd: restarting vpnd`

* *$FWDIR/log/vpnd.elg* shows that VPND daemon is restarted every 5 minutes.

  *Example*:

  ```
  
  [vpnd 1499 ...]@HostName[10 Apr 15:56:37] vpnd: Thu Apr 10 15:56:37 2014
  [vpnd 1499 ...]@HostName[10 Apr 15:56:37] ------------ VPND Starting: Thu Apr 10 15:56:37 2014
  [vpnd 3992 ...]@HostName[10 Apr 16:01:37] vpnd: Thu Apr 10 16:01:37 2014
  [vpnd 3992 ...]@HostName[10 Apr 16:01:37] ------------ VPND Starting: Thu Apr 10 16:01:37 2014
  [vpnd 6486 ...]@HostName[10 Apr 16:06:37] vpnd: Thu Apr 10 16:06:37 2014
  [vpnd 6486 ...]@HostName[10 Apr 16:06:37] ------------ VPND Starting: Thu Apr 10 16:06:37 2014
  ```

* Debug of VPND daemon per [sk89940](http://supportcontent.checkpoint.com/solutions?id=sk89940) shows that it tries to resolve 3rd party CA (for CRL verification).

  *Example*:

  ```
  
  [vpnd PID ...]@HostName[Date Time] calling async resolve for crl.comodoca.com
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname: Performing gethostbyname for crl.comodoca.com
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname: Failed to resolve hostname 'crl.comodoca.com'
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname6: Performing getaddrinfo with PF_INET6 for host crl.comodoca.com
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname6: getaddrinfo failed. reason=Name or service not known
  [vpnd PID ...]@HostName[Date Time] calling async resolve for crl.comodoca.com
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname: Performing gethostbyname for crl.comodo.net
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname: Failed to resolve hostname 'crl.comodo.net'
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname6: Performing getaddrinfo with PF_INET6 for host crl.comodo.net
  [vpnd PID ...]@HostName[Date Time] resolver_gethostbyname6: getaddrinfo failed. reason=Name or service not known
  ```

## Cause

DNS resolution fails for 3rd party CA. As a result, VPND daemon does not respond to FWD daemon, which restarts it.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content