> Source: [sk172610](https://support.checkpoint.com/results/sk/sk172610)

# sk172610 - "Failed creating certificate. Certificate with a different letters' case exists" error when trying to create a Gateway / Cluster object

| Property | Value |
|----------|-------|
| Solution ID | sk172610 |
| Date Created | 2021-04-07 |
| Last Modified | 2025-06-12 |
| Technical Level | General |
| Products | Security Management Server, SmartConsole |
| Versions | R81 (EOS), R81 (EOS) |

## Symptoms

- "Failed creating certificate. Certificate with a different letters' case exists" error when creating a Gateway / Cluster object with the same name as a deleted object.

## Cause

A VPN certificate of a previously deleted object has not been revoked.  
The name of the new object is the same as in the certificate, but has a different case.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 42

If you choose not to upgrade:  
In order to confirm the exact name of the deleted object you can use the following procedure:  

1. Turn on cpca and fwm debug on the Security Management server:

   `fw debug fwm on TDERROR_DBG_OPT=time,host,prog,topic,pid,tid`

   `fw debug fwm on TDERROR_ALL_ALL=5`

   `fw debug cpca on TDERROR_ALL_ALL=5`

   `tail -f $MDS_FWDIR/log/cpca.elg &> ~/cpca_debug.elg &`

   `tail -f $MDS_FWDIR/log/fwm.elg &> ~/fwm_debug.elg &`

   **Imprtant note:** As the debug can have performance impact on the server it is highly advised to run it during a maintenance window.
2. Create the Gateway/Cluster with the same name which is causing the issue. The object name "AZPHIFW-CLUSTER" is used in the below example.

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/step_1202104071311121.jpg)

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/step_2202104071311312.jpg)
3. Check cpca_debug.elg and search for similar logs:

   `[cpca PID]@Hostname[DATE TIME] ICAsqlDB::SameDNCase: certificates are not with the same DN case.`  
   `[cpca PID]@Hostname[DATE TIME] ICAsqlDB::SameDNCase: cert_dn is CN=AZPHIFW-Cluster VPN Certificate,O=gw-769885..q4zhzp`  
   `[cpca PID]@Hostname[DATE TIME] ICAsqlDB::SameDNCase: dn_str is CN=AZPHIFW-CLUSTER VPN Certificate,O=gw-769885..q4zhzp`  
   `[cpca PID]@Hostname[DATE TIME] fwCA::CreateIkeCert: cert with different case already exist. cn_str is "CN=AZPHIFW-CLUSTER VPN Certificate" full dn is "CN=`  
   `AZPHIFW-CLUSTER VPN Certificate,O=gw-769885..q4zhzp"`
4. Check fwm_debug.elg and search for similar logs:

   `[FWM PID]@Hostname[DATE TIME][CA] fwca_client_command_cb: called callback`  
   `[FWM PID]@Hostname[DATE TIME] EnrollForInternalCACert_cb: Failed creating certificate. Certificate with a different letters' case exists.`  
   `[FWM PID]@Hostname[DATE TIME] fwm_AutomaticEnrollCb: errmsg=Failed creating certificate. Certificate with a different letters' case exists`  
   `[FWM PID]@Hostname[DATE TIME] AutomaticEnrollSendReply: Failed creating certificate. Certificate with a different letters' case exists`  
   `[FWM PID]@Hostname[DATE TIME] cpmi_send_sset: session=0x0c23e9e0, id=405, last=1, set=`  
   `(`  
   ` :body (`  
   ` :reason (-91)`  
   ` :error ("Failed creating certificate. Certificate with a different letters' case exists")`  
   ` :message ("Certificate operation failed")`  
   ` :operation-ok (false)`  
   ` )`  
   ` :subject (operation-done)` `)`
5. Turn off the cpca + fwm debugs:

   `fw debug cpca off`

   `fw debug fwm off TDERROR_ALL_ALL=0`
6. Use this command to print the certificate:

   `cpca_client lscert -stat Valid | grep -A3 AZPHIFW`

   Output for example:

   `Subject = CN=AZPHIFW-Cluster VPN Certificate,O=gw-769885..q4zhzp `

   `Status = Valid Kind = IKE `**Serial = 77730**` DP = 3 `

   From the output you can see the the deleted object exact name is: "**AZPHIFW-Cluster**".

In order to create the new Gateway / Cluster use **one** of the two following options:  

<br />

1. Revoke the aforementioned certificate:
   * *# cpca_client revoke_cert -s <Certificate Serial Number>*
2. Create the object with a **new** name (different combination of chars and number and length), for example: "*AZPHIFW-New-Cluster*"

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/step_3202104071326181.jpg)

1.
   1. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/step_4202104071328122.jpg)
2. Create the object in the exact name and case of the previous object, in the above example: "AZPHIFW-Cluster"

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/Step_5202104071329553.jpg)

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk172610/Step_6202104071330284.jpg)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content