> Source: [sk116340](https://support.checkpoint.com/results/sk/sk116340)

# sk116340 - Security Gateway tries to fetch CRL even though CRL is distributed over IKE

| Property | Value |
|----------|-------|
| Solution ID | sk116340 |
| Date Created | 2017-03-13 |
| Last Modified | 2025-01-22 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |

## Symptoms

- * Peer sends CRL over IKE, but the Security Gateway still tries to fetch it from the CRL Distribution Points - i.e. sending HTTP or LDAP request.  

  If the CRL Distribution Point is unreachable, IKE negotiation would fail with "`invalid certificate`" error.

* Debug of VPND daemon (per [sk89940](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk89940)) shows:  

  `fwFetchCRL_e_With_Reason: CRL was not found in cache. Will fetch it async.`

## Cause

CRL caching for Security Gateways is disabled in the Internal CA object.

When CRL payload is received in IKE packet 5 or IKE packet 6, it is saved in the cache.  
When validating the certificate, the cache is checked first, but if cache is disabled  
(or if the relevant CRL is not there), then VPND moves on to the other CRL fetch methods.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content