> Source: [sk179631](https://support.checkpoint.com/results/sk/sk179631)

# sk179631 - CME unable to connect to public or private metadata services

| Property | Value |
|----------|-------|
| Solution ID | sk179631 |
| Date Created | 2022-06-30 |
| Last Modified | 2022-07-06 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R81.10 (EOS) |

## Symptoms

- * CME is unable to connect to public or private metadata services.

* "Could not validate local issuer certificate" from 'service cme test' or on */var/log/CPcme/cme.log*.

## Cause

HTTPS Inspection secures access to cloud metadata services. The Security Gateway drops the connection because the received server certificate is not trusted.

## Solution

The products are functioning as designed. Traffic to the cloud metadata services should fail if a security issue is detected (such as man-in-the-middle).   

If HTTPS inspection bypass is not possible / not allowed, submit a [Request for Enhancement](https://www.checkpoint.com/rfe/login.htm) for this feature.   

If you cannot add a bypass to the external HTTPS inspection service, there is a temporary workaround to add the inspection certificate to the trusted CA's.  

Carry out this procedure on the Check Point Security Management Server and HA Management for CME.   

(If you find similar issues in Azure / AWS / etc HA daemons, you can try this also on gateways.)  

1. Get the HTTPS inspection CA certificate (public part) from the relevant team. If this is not possible and the certificate is installed on Windows, you can export it:   

   Open the certificate -\> Detail tab -\> Copy to File... -\> select Base-64... and save *private-certificates.cer* .  

2. Copy the certificate to the Security Management / Multi-Domain Management Server.  

3. Log into the Security Management Server via SSH and go to Expert mode.  

4. Back up the folder *$CPDIR/conf/public-cloud* .   

   `tar cvzf ./cpdir_public_cloud_bak.tgz $CPDIR/conf/public-cloud`  

5. Enter the *$CPDIR/conf/public-cloud* directory, and find the file with the latest updated date in the first line of the file:   

   `head -2 *.crt`  

   and look for the latest date in YYYYMMDD format.  

6. Copy this file to a new filename. Example:   

   `cp <sourcefilename> public-cloud-with-httpsi-cert.crt`  

   The HTTPS inspection certificate is appended to this file to make it trusted in the next steps.   

7. Convert the uploaded certificate to the required format:   

   `cpopenssl x509 -text <https_inspection_certificate_file`  

8. If there are no errors, and the output looks equivalent to the contents of the crt files, continue with appending the certificate to the file:   

   `cpopenssl x509 -text < https_inspection_certificate_file >> public-cloud-with-httpsi-cert.crt`  

9. Restart the required service:  

   `service cme restart`  

10. Verify that:
    1. The added certificate is merged into the main CA bundle, *$CPDIR/conf/ca-bundle-public-cloud.crt*
    2. There are no certificate errors in */var/log/CPcme/cme.log* .  

11. Stop the CME from autoupdating (see below) with:   

    `autoupdatercli disable CME`  

12. Repeat on the HA Security Management Servers.

<br />

Notes:  

* A new certificate bundle is placed in *$CPDIR/conf/public-cloud* each time CME is updated.
* This workaround can be overwritten if a different update to the public cloud certificates is issued.
* This workaround does not survive upgrades or hotfix installations.
* You must periodically check for CME updates, apply them, and repeat the workaround procedure above.
* In addition this can apply to other daemons in the public cloud. Example: Azure and AWS HA functionality, CPUSE / CPDA, Autoupdater, CloudGuard Controller, etc.
As above, create an RFE to have 3rd-party HTTPS inspection certificates managed centrally in a unified and automated manner as an official solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content