> Source: [sk180683](https://support.checkpoint.com/results/sk/sk180683)

# sk180683 - Check Point Gateway is not sending the 3rd party certificate that uses OCSP it was set to send for site-2-site VPN or Remote Access VPN but instead send the defaultCert

| Property | Value |
|----------|-------|
| Solution ID | sk180683 |
| Date Created | 2023-03-02 |
| Last Modified | 2023-07-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Check Point Gateway is not sending the 3rd party certificate it was set to send for site-2-site VPN or Remtoe Access VPN but instead send the defaultCert
* vpnd.elg / iked.elg show the following lines up to 20 minutes from policy installation:  
  \[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN--CRT from Global Key Holder  
  \[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN--CRT from IKE Key Holder  
  \[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN--CRT from SSL Key Holder  
* vpnd.elg or iked.elg will show one of these 3 lines:  
  \[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -949  
  \[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -957  
  \[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -958

## Cause

The issue happens because after policy install Check Point is starting to check and validate its own 3rd party certs.  
If there is a 3rd party certs the gateway is trying to validate but it fails for one of these 3 reasons:  

OCSP unauthorized will be seen in vpnd.elg / iked.elg as   
\[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -949.  

OCSP connect failed will be seen in vpnd.elg / iked.elg as  
\[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -957  

OCSP timeout will be seen in vpnd.elg / iked.elg as   
\[OCSP\] fwFetchOCSP_cb: all CRL and OCSP responses are received, calling CB with rc: -958  

Before the fix the Check Point gateway would have removed that certificate from its database and will not try to use it again which may lead to failures (as unwanted certificate, usually the defaultCert will be sent instead while the peer expect the 3rd party certificate).  

You will see the lines:  

\[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN-\<GW_NAME\>-CRT from Global Key Holder  
\[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN-\<GW_NAME\>-CRT from IKE Key Holder  
\[vpnd 3037 4071122944\]@FW02\[3 Feb 12:17:32\] fwKeyStore::RemoveCertKey: Removed VPN-\<GW_NAME\>-CRT from SSL Key Holder   

After the fix the gateway will not remove those certificates but will attempt to validate them every 15 minutes.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 110
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 87
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 198

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content