> Source: [sk147836](https://support.checkpoint.com/results/sk/sk147836)

# sk147836 - Global VPN community fails to establish VPN tunnels after an upgrade

| Property | Value |
|----------|-------|
| Solution ID | sk147836 |
| Date Created | 2019-02-27 |
| Last Modified | 2020-11-12 |
| Technical Level | General |
| Products | Multi-Domain Security Management Server |
| Versions | R82.10, R81.20, R82, R82.20 |

## Symptoms

- * After a Multi-Domain Management Server upgrade, the VPN tunnels to the peer gateway using the Global VPN community fail to establish.
* The negotiation of the VPN tunnel fails with invalid certificate, due to the failure in certificate trust.
* PUV message: The 'Internal CA' certificates in the database must be fixed post upgrade.

## Cause

There is more than 1 certificate for every Internal CA.

This cause the CMA not to recognizing the other CMA's ICAs.

## Solution

Delete the duplicates certificates in the DB.

1. Take a snapshot (**important!** ) before executing the script.  

2. Download [RemoveDuplicateInternalCACertificates.tgz](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=86048)  

3. Move the tgz file to the machine home directory.  

4. Extract RemoveDuplicateInternalCACertificates.groovy script  

5. Assign the required permissions:  
   `# chmod +x RemoveDuplicateInternalCACertificates.groovy`   

6. Run the script: `# $MDS_FWDIR/scripts/run_groovy_script.sh ~/RemoveDuplicateInternalCACertificates.groovy`

<br />

**Example output of the script while running:**   
*\[Expert@Gateway:0\]# $MDS_FWDIR/scripts/run_groovy_script.sh \~/RemoveDuplicateInternalCACertificates.groovy*   
*Loading groovy script engine ...*   
*SLF4J: Class path contains multiple SLF4J bindings.*   
*SLF4J: Found binding in \[jar:file:/opt/CPsuite-R80.40/fw1/cpm-server/slf4j-log4j12-1.6.1.jar!/org/slf4j/impl/StaticLoggerBinder.class\]*   
*SLF4J: Found binding in \[jar:file:/opt/CPsuite-R80.40/fw1/cpm-server/activemq-all-5.9.0.jar!/org/slf4j/impl/StaticLoggerBinder.class\]*   
*SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.*   
*09:32:55,746 INFO com.checkpoint.management.cpm.Cpm.enableLocalSic:142 \[main\] - Enabling local sic. Setting cp.ssl_local.certificate.check=local*   
*09:32:55,846 INFO com.checkpoint.management.cpm.configuration.Utils.setTdLogConfigFile:20 \[main\] - Starting to configure logging options*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content