> Source: [sk174190](https://support.checkpoint.com/results/sk/sk174190)

# sk174190 - Internal CA certificate is served in clear traffic on external interfaces

| Property | Value |
|----------|-------|
| Solution ID | sk174190 |
| Date Created | 2021-07-01 |
| Last Modified | 2022-12-01 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R81 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- The web page for downloading internal CA certificates is available from external interfaces (port 18264) along with The CRL (Certificate Revocation List) download services, and without SSL.

## Cause

Because the end-user does not trust the Internal CA yet (which is the reason for downloading the public key in the first place), it is illogical to make this portal in HTTPS. This portal is also used for CRL download which is in clear HTTP by definition, for similar reasons.

## Solution

This problem was fixed. The fix is included in:

* [**Check Point R81.10**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416)

Check Point recommends to always [upgrade to the most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184).  

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.  

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).  

<br />

Because the download of the CA certificate (public key) over an untrusted channel can be risky, the portal for downloading Internal CA related information was split into two:  

* The CA Certificate services web page moved to port 18268 and is not reachable by default (only when activated using the `cpca_client` command).
* The CRL (Certificate Revocation List) download remains on port 18264 as it was.

**How to Enable the Certificate Authority Services Portal with the fixed version:
Procedures for the Security Management Server**   

**Enabling the Certificate Authority Services Portal on the Security Management Server:**

1. Connect to the command line on the Security Management Server.
2. Log in to Expert mode.
3. Enable the Certificate Authority Services Portal:  
   `cpca_client set_ca_services on`
4. With a web browser, connect to:  
   `http://<IP Address of Security Management Server>:18268`
5. Download the required certificate.
6. Install this certificate on the applicable computers.

**Disabling the Certificate Authority Services Portal on the Security Management Server:**   

1. Connect to the command line on the Security Management Server.
2. Log in to Expert mode.
3. Disable the Certificate Authority Services Portal:  
   `cpca_client set_ca_services off`

**Procedures for the Multi-Domain Management Server
Enabling the Certificate Authority Services Portal on the Multi-Domain Management Server:**

1. Connect to the command line on the Multi-Domain Server.
2. Log in to Expert mode.
3. Go to the context of the Domain Management Server:  
   `mdsenv <IP Address or Name of Domain Management Server>`
4. Enable the Certificate Authority Services Portal:  
   `cpca_client set_ca_services on`
5. With a web browser, connect to:  
   `http://<IP Address of Domain Management Server>:18268`
6. Download the required certificate.
7. Install the certificate on the applicable computers.

**Disabling the Certificate Authority Services Portal on the Multi-Domain Management Server:**   

1. Connect to the command line on the Multi-Domain Management Server.
2. Log in to Expert mode.
3. Go to the context of the Domain Management Server:  
   `mdsenv <IP Address or Name of Domain Management Server>`
4. Disable the Certificate Authority Services Portal:  
   `cpca_client set_ca_services off`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content