> Source: [sk179586](https://support.checkpoint.com/results/sk/sk179586)

# sk179586 - "SIC Error for EntitlementManager: Peer sent wrong DN: CN=xxx,O=xxx" in cpd.elg during boot or after running the 'cpstart' command on a Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk179586 |
| Date Created | 2022-07-12 |
| Last Modified | 2023-09-09 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * "*SIC Error for EntitlementManager: Peer sent wrong DN: CN=xxx,O=xxx*" appears on the screen of a Security Gateway:

  * While connected through the console port, this message appears during boot

  * While connected to the command line, this message appears after running the '`cpstart`' command

* In SmartConsole, in the Security Gateway object, the "Test SIC Status" operation shows "Communicating", and policy installation succeeds.

* This issue was observed in these cases:

  * An environment with Multi-Domain Servers in Management High Availability

  * An environment with a Multi-Domain Server that in the past was part of Management High Availability

## Cause

This issue may happen if the Management Server was in the past promoted from Secondary to Primary:

1. By default, the Primary Management Server object has the canonical name "*CN=cp_mgmt*".
2. In Management High Availability, the Secondary Management Server has the canonical name "*CN=cp_mgmt\<Name_of_Secondary_Server_Object\>*".
3. When the Security Gateway is fetching its policy, it is always looking for the canonical name "*CN=cp_mgmt* " in the file *$FWDIR/conf/masters* and connects to the corresponding Management Server's IP address.
4. Because this Management Server was Secondary in the past, the canonical name it sends to the Security Gateway, is not "*CN=cp_mgmt*".
5. The Security Gateway compares the canonical name it receives from the Management Server to the canonical name in the file *$FWDIR/conf/masters*.
6. As a result, the Security Gateway shows the message "*SIC Error for EntitlementManager: Peer sent wrong DN*".

## Solution

This problem was fixed. The fix is included in:

* [Check Point R81.20 (Titan)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173903)
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 72
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 180

If you choose not to upgrade, follow these steps:

**Important** - **This workaround is only temporary** . Security Gateway / Cluster Members may overwrite the *$FWDIR/conf/masters* file in the future.

1. On the Multi-Domain Server:

   1. Connect to the command line on the Multi-Domain Server.

   2. Log in to the Expert mode.

   3. Go to the context of the applicable Domain Management Server that manages this Security Gateway / Cluster:

      `mdsenv <IP Address or Name of Domain Management Server>`
   4. Get the correct CN string for the Domain Management Server:

      `grep MySICname $CPDIR/registry/HKLM_registry.data`

      Example output:

      `:MySICname ("CN=cp_mgmt_MySecondaryMDS,O=MySecondaryMDS..6oft4v")`
2. On the Security Gateway / each Cluster Member:

   1. Connect to the command line on the Security Gateway / each Cluster Member.

   2. Log in to the Expert mode.

   3. Back up the current *$FWDIR/conf/masters* file:

      `cp -v $FWDIR/conf/masters{,_BKP}`
   4. Edit the current *$FWDIR/conf/masters* file:

      `vi $FWDIR/conf/masters`
   5. Replace the current CN string with the string you received on the Domain Management Server.

      Example:
      > from:
      >
      > ```
      > 192.168.20.30  ;       CN=cp_mgmt,O=MySecondaryMDS..6oft4v
      > ```
      >
      > to:
      >
      > ```
      > 192.168.20.30 �;       CN=cp_mgmt_MySecondaryMDS,O=MySecondaryMDS..6oft4v
      > ```

   6. Save the changes in the file and exit Vi editor.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content