> Source: [sk116997](https://support.checkpoint.com/results/sk/sk116997)

# sk116997 - Endpoint Security VPN client using SHA256 certificate from the CAPI store fails to connect to VPN Gateway with "Internal error" message

| Property | Value |
|----------|-------|
| Solution ID | sk116997 |
| Date Created | 2017-04-26 |
| Last Modified | 2024-06-04 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Symptoms

- * Endpoint Security VPN client fails to connect to VPN Gateway with "`Internal error`" message.

* Endpoint Security VPN client is configured for \*.P12 certificate authentication.

  The \*.P12 certificate was signed with SHA256 and imported into the CAPI store.

  <br />

* SHA256 is defined as the Data Integrity Option under: Smart Console \> Global Properties \> Remote Access \> VPN - Authentication \> IKE Security Association (Phase 1) \> "Use Data Integrity".

* If the same certificate from the CAPI store is used to authenticate with IKE Data Integrity set to SHA1, then the client is able to connect.

* When the Endpoint Security VPN client authentication is set to use SHA256 as the Data Integrity option, and the \*.P12 certificate authentication is set directly in from client instead of CAPI store, then the client is able to connect.

* Debug of Client (trac.log) while using the SHA256 certificate from the CAPI store, shows:

  ```
  
  fwCAPIPubKey_imp::fwCAPIPubKey_imp: provider = 'Microsoft Enhanced Cryptographic Provider v1.0' container='{...}'
  [] fwCAPIPubKey_imp::SetFlags: CAPI key flags:PUBKEY_PRIVATE + PUBKEY_SIGN + PUBKEY_SOFTWARE.
  [] fwCAPIPubKey_imp::Sign: CAPI sign.
  [] fwCAPIPubKey_imp::Sign: in
  Vista_IsExecutedAsService(), len = 0
  [] CapiUserProcSign::Init: Will get required out buffer length
  [] CapiUserProcSign::DoAction: After wake up process
  [] CapiUserProcPKCS7::TriggerAction: Set Event
  [] CapiUserProcInteract::WaitForProcResponse:CAPI Proc returned with failure
  [] CapiUserProcSign::ActionWaitAndHandleResult: Signing failed
  [] CapiUserProcSign::DoAction: Failed to wait and handle reponse
  fwCAPIPubKey_imp::Sign: Failed to get signed result
  [Rais_CAPICERT] Rais_CAPICERT::capi_cert_sign: Failed to sign buffer
  [Rais_CAPICERT] capi_cert_sign: __end__
  [RunAs] FreeSecurityContextInformation: Ended
  [RunAs] SCRunFuncAsUser: Ended
  [Rais_CAPICERT] CAPICert::Sign: __end__
  [IKE] create_MM5(certificates authentication): Failed to sign hash (-996)
  [DEBUG] [RaisMessages::CreateMessageSet(s)]
  message: (msg_obj
    :format (1.0)
    :id (ClipsMessagesInternalError)
    :def_msg ("Internal error; connection failed. More details may be available in the logs")
    :arguments ()
  )
  ```

## Cause

* The [Cryptographic Service Provider (CSP)](https://en.wikipedia.org/wiki/Cryptographic_Service_Provider) used for the involved certificate is "Microsoft Enhanced Cryptographic Provider v1.0" that does not support SHA256 (refer to [CryptoAPI Cryptographic Service Providers](https://msdn.microsoft.com/en-us/library/windows/desktop/bb931357(v=vs.85).aspx) - only "Secure Hash Algorithm (SHA1)" is listed for this CSP).  

* When selecting SHA256 for the IKE Data Integrity, the client certificate from the Cryptographic Service Provider (CSP) as referenced above, will not support this option and the issue will be seen.  

* Endpoint Security VPN clients prior to E81.10 do not support SHA2 certificates from the CAPI store.
For example the client certificate uses "Microsoft Enhanced Cryptographic Provider v1.0" CSP, which does not support SHA256, while SHA256 is configured for IKE Data Integrity

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content