> Source: [sk181142](https://support.checkpoint.com/results/sk/sk181142)

# sk181142 - Log Exporter TLS Configuration in Smart-1 Cloud

| Property | Value |
|----------|-------|
| Solution ID | sk181142 |
| Date Created | 2023-06-30 |
| Last Modified | 2026-04-06 |
| Technical Level | General |
| Products | Smart-1 Cloud |
| Versions | Cloud |

## Solution

**Note** : If it is necessary to configure TLS in an on-premises Security Management Server, refer to [sk122323](https://support.checkpoint.com/results/sk/sk122323) \> **TLS Configuration**.

Because of the Cloud structure and the routing functions, there are some differences in the configuration of TLS Log Exporter in the Smart-1 Cloud environment.
Log Exporter can export logs over an encrypted connection with the TLS protocol. When you use TLS, only mutual authentication is allowed.  

For mutual authentication, the Log Exporter needs these certificates:  

* CA certificate (in the PEM format) that signs the client (Smart-1 Cloud) certificate and signs the server (SIEM) certificate. The CA certificate can be a self-signed certificate.
* The client certificate.

### Notes

* The Management Server / Log Server with Log Exporter must have connectivity to the CA server.

* In addition to these two certificates, you must install a third certificate on the Syslog server (based on the server requirement). You can use self-signed certificates.

* Log Exporter supports only keys encrypted and signed with the RSA for TLS communication (ECC keys are not supported).

* The procedure below uses the OpenSSL commands on a non-Check Point server.

### Part 1 - Create a CA Certificate

1. Create a CA Key file:

   `openssl genrsa -out ca.key 2048`
2. Create a CA Certificate file:

   `openssl req -x509 -new -nodes -key ca.key -days 2048 -out ca.pem`

You are required to provide information regarding the certificate. Apart from the Common Name, all other fields are optional, and you can skip them.

For more information, refer to the [Smart-1 Cloud Administration Guide](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Default.htm#cshid=ID11) \> Chapter "Using the Settings" \> Section "Forwarding Events to SIEM" \> Section "Troubleshooting".

### Part 2 - Create a Log Exporter Certificate

1. Sign in to [Check Point Infinity Portal](https://portal.checkpoint.com).

2. Open the **Smart-1 Cloud** service.

3. Click **Settings** -\> **Forward to SIEM**.

   Click **New** or **Edit** and click the **Client Certificate** button to download the certificate sign request (CSR).
4. Move the CSR file to the SIEM server where you were creating CA certificates.

5. On the SIEM server, create a Log Exporter CRT file:

   `openssl x509 -req -in <certificate request file name>.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out cp_client.crt -days 2048 -sha256`

   Example:

   `openssl x509 -req -in cp_client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out cp_client.crt -days 2048 -sha256`

### Part 3 - Create a Syslog Server Certificate

1. Create a Target Server key file:

   `openssl genrsa -out server.key 2048`
2. Create a Target Server CSR file:

   `openssl req -new -key server.key -out server.csr`
3. Create a Target Server CRT file:

   `openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.crt -days 2048 -sha256`

**Note:** Several SIEM applications require the Server certificate to be in a specific format. For more information, refer to [sk122323](https://support.checkpoint.com/results/sk/sk122323) \> Section "SIEM Specific instructions".

### Part 4 - Add the certificate files to the Check Point Management Server / Log Server

Upload the new `cp_client.crt` and `ca.pem` files in Infinity Portal:

1. Navigate to **Settings** \> **Forward to SIEM**.

2. Click **New** (or **Edit**, to change the existing Log Exporter instance).

3. Fill in the applicable details and click **Add**:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181142/siam202307061021351.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content