> Source: [sk172188](https://support.checkpoint.com/results/sk/sk172188) # sk172188 - Public Cloud CA Bundle for Cloud Firewall Release Updates | Property | Value | |----------|-------| | Solution ID | sk172188 | | Date Created | 2021-10-25 | | Last Modified | 2026-10-18 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81 (EOS), R81.10 (EOS), R81.20, R82, R82.20 | | OS | Gaia | ## Solution **Introduction \| Availability \| Manual Installation \| Installation Troubleshooting \| List of Resolved Issues** Introduction {#Introduction} ---------------------------- **Public Cloud CA** **for Cloud Firewall** (formerly known as CloudGuard) Bundle contains certificates of root certificate authorities that are used to sign the public keys of the API servers of public cloud providers. The certificates allow API clients in Check Point solutions to validate the authenticity of API servers of cloud platforms such as AWS (Amazon Web Services), Azure, GCP (Google Cloud Platform), and more. You can install the Public Cloud CA Bundle on Security Management Server, Multi-Domain Management Server, Security Gateways, Standalone deployed in cloud platforms or on-premises machines. **Important:**It is essential to keep the Public Cloud CA Bundle up to date with Automatic Updates. The Public Cloud CA package is installed automatically on all relevant Check Point devices when Automatic Update downloads are enabled (see [sk175504](https://support.checkpoint.com/results/sk/sk175504), section 2-B). If Automatic Updates are disabled, you must first install the latest AutoUpdater Take manually, then install the Public Cloud CA package using the steps in the Manual Installation section below. Availability {#Prerequisites} ----------------------------- |------------------|---------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| | | Take # | Release Date | Offload Package Link | | Recommended Take | Take 23 | 22 Sep 2026 | [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk172188/download202202081243441.png)](https://support.checkpoint.com/results/download/145310) (TAR) | Manual Offline Installation {#Manual Installation} -------------------------------------------------- 1. Log in to the Check Point machine via SSH. 2. Transfer the offline package to the machine. 3. From Expert mode, run: `autoupdatercli install .tar` Example: `autoupdatercli install /home/admin/_Check_Point_ PUBLIC CLOUD CA BUNDLE _AUTOUPDATE_Bundle_T23_AutoUpdate.tar` On the Scalable Platform Security Group: `g_all autoupdatercli install ` 4. Validate that the installation passed successfully by checking the */opt/CPInstLog/AutoUpdateLogs/public_cloud_ca_bundle* log. Installation Troubleshooting {#Installation Troubleshooting} ------------------------------------------------------------ These issues can rise when running the installation package: * **Issue 1: "Failed to download latest Public Cloud CA Bundle."** > Solution: If you have no internet access, follow the instructions for "Offline Package Installation Procedure" in the Installation Instructions section above.
* **Issue 2: "A version of Public Cloud CA bundle is already installed via AutoUpdater"** > Solution: Public Cloud CA Bundle has already been installed for the first time and is configured to receive updates automatically. If you have no internet access, follow the instructions for "Offline Package Installation Procedure" in the Installation Instructions section above.
* **Issue 3: You want to return to previous version of Public Cloud CA bundle** > Solution: It is highly recommended that you use the latest take of Public Cloud CA bundle. > > If you still want to revert to the previous take, run the following command in Expert mode: > > `autoupdatercli revert public_cloud_ca_bundle` > > The revert takes up to 1 minute. > > To make sure Public Cloud CA Bundle was reverted to the previous take, run this command in the Expert mode: > > `cpinfo -y CPUpdates 2>&1 | grep PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE` > > The take number in the output must be the one to which you reverted. > > Notes: > * Public Cloud CA Bundle is upgraded automatically each time a new take is released. > > * You can revert only to the previous version. A revert to older versions reverts Public Cloud CA Bundle completely and removes it from the machine.

* **Issue 4: You want to totally remove Public Cloud CA bundle** > Solution: Run the following command in Expert mode: > > `autoupdatercli revert-completely public_cloud_ca_bundle` > > The revert takes up to 1 minute. > > To make sure Public Cloud CA Bundle was reverted completely, run this command in the Expert mode: > > `cpinfo -y CPUpdates 2>&1 | grep PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE` > > If you also wish to stop receiving future updates of Public Cloud CA Bundle after the removal, run the following command in Expert mode: > > `autoupdatercli disable public_cloud_ca_bundle` > > The output must show "0".
If your issue is not resolved by one of the above solutions, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) and attach the log files from */opt/CPInstLog/AutoUpdateLogs/PUBLIC_CLOUD_CA_BUNDLE* List of Resolved Issues and New Features per Public Cloud CA Bundle Update {#List of Rresolved Issues} ------------------------------------------------------------------------------------------------------ |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Description | | **Take 23 (22 Sep 2026)** || | - | Maintenance update: packaging infrastructure only. No changes to the certificate content. | | **Take 21 (30 Jun 2024)** || | VSECPC-7604 | Enhancement: Removed expired Google Cloud Platform (GCP) certificates from the *ca-bundle-public-cloud.crt* file. This file is installed to *$CPDIR/conf/* and copied by the package to *$CPDIR/conf/public-cloud/* . The bundle also delivers *public-cloud-certificate.crt* to *$CPDIR/conf/public-cloud/.* Note: Adding permissions for others to access this file does not reduce security confidence. This is because the public-cloud folder contains only CA bundles with public certificates, which are not considered sensitive data. | | **Take 20 (24 Jul 2023)** || | VSECPC-6785 | Enhancement: *PUBLIC_CLOUD_CA_BUNDLE DDR conditions-set* now blocks installation on Maestro machines. | | **Take 19 (06 Sep 2022)** || | PMTR-85947 | Enhancement: Added support for Log Server. | | **Take 18 (20 Mar 2022)** || | VSECPC-5597 | Enhancement: Added a new Azure certificate for the Storage service. | | **Take 14 (09 Feb 2022)** || | - | First release of Public Cloud CA Bundle Update. |
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content