> Source: [sk167177](https://support.checkpoint.com/results/sk/sk167177)

# sk167177 - DynamicID authentication fails due to server certificate validation failure, if the server certificate does not contain a CRL distribution point

| Property | Value |
|----------|-------|
| Solution ID | sk167177 |
| Date Created | 2020-06-01 |
| Last Modified | 2021-07-18 |
| Technical Level | General |
| Products | Security Gateway, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, E89.X, E88.X |

## Symptoms

- * DynamicID authentication fails due to a server certificate validation failure, if the server certificate does not contain a CRL distribution point.

* Following errors are found when running the relevant user mode process debug, for example: In $FWDIR/log/cvpnd.elg in case of having issues with MAB portal using dynamic ID
  , or in $FWDIR/log/vpnd.elg in case of Remote Access VPN issue using dynamic ID:

  * Certificate who has OCSP url only (And no CRL):

    `cp_verify_certificate: chain level: 0, error: Could not retrieve CRL. OR cp_verify_certificate: Error - certificate #0 has no CRL-DP but has OCSP url. failing...`  
    `
    finished with result code (-10) - (servercert: Error - server certificate validation failed!)`  
    `
    [AU] dynamic_id_manager_callback(au=e13cece8): DynamicID faliure`  
    `
    [CPSC] cpsc_get_msg_by_id: Cache HIT for CPSC_DID_REQUEST_FAILED`
  * Certificate who has no CRL DP and no OCSP url:

    `cp_verify_certificate: certificate #%d has no CRL-DP/OCSP url. skipping...`

## Cause

The system considers the server certificate to be "untrusted", if it does not contain a CRL DP (Certificate Revocation List Distribution Point) and has OCSP only.

The system considers the server certificate to be "trusted", if it does not contain both CRL DP and OCSP url. This issue was fixed, refer "solution" section.

## Solution

This problem was fixed. The fix is included in:

* For certificates without CRL DP and without OCSP url, the issue is fixed. The fix is included in:

  * [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)
  * [Jumbo Hotfix Accumulater for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 78
  * [Jumbo Hotfix Accumulater for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 219
  * [Jumbo Hotfix Accumulater for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 183
  * [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 283
* For certificates with OCSP url only (Without CRL DP), the issue is fixed. The fix is included in:

  * [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)
  * [Jumbo Hotfix Accumulater for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 89

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

<br />

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Important note** : "OCSP support for libcurl flow is not supported on R80.30, it's a known limitation."  

**Related Solution:** [sk173971 -VPN Users fail to authenticate with Certificates, validation fails due to wrong handling of root CA](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173971).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content