> Source: [sk131212](https://support.checkpoint.com/results/sk/sk131212)

# sk131212 - Security gateway portals on port 443 receive incorrect certificate

| Property | Value |
|----------|-------|
| Solution ID | sk131212 |
| Date Created | 2018-07-19 |
| Last Modified | 2023-08-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |

## Symptoms

- * After a UserCheck certificate update, an incorrect certificate is presented to VPN clients on connect/site creation.
* Alternatively, internal users may be presented with the VPN certificate on the UserCheck web page when accessing UserCheck via an internal interface (when they expect to see the VPN certificate only on the external interface).
* The configured certificate for Identity Awareness is the UserCheck certificate, however sometimes the clients receive a trust error and instead of UserCheck certificate, we can see the VPN certificate.

## Cause

When a certificate was updated to a particular portal it was presented not only to users via internal interface for that particular portal, but also to users via external interface for other portals that were configured with the default certificate (and expected to see the default certificate).  

This occurred due to incorrect handling by the code.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 10
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 87
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152&partition=Basic&product=Endpoint) starting from Take 227
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 187
* [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 288

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

<br />

To **enable** the solution run in the Security Gateway:  

1. **`ckp_regedit -a SOFTWARE/CheckPoint/VPN1 CertificatePrioritization -n 0`**
2. **`cpstop; cpstart`**

To **disable** the solution run in the Security Gateway:

1. **`ckp_regedit -a SOFTWARE/CheckPoint/VPN1 CertificatePrioritization -n 1`**
2. **`cpstop; cpstart`**

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content