> Source: [sk181452](https://support.checkpoint.com/results/sk/sk181452)

# sk181452 - VPN Client connection is stuck at 47% and TracSrvWrapper service hangs on Windows PC when certificate authentication is used with USB security key or a 3rd party Certificate manager software

| Property | Value |
|----------|-------|
| Solution ID | sk181452 |
| Date Created | 2023-11-23 |
| Last Modified | 2024-03-02 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X, R82.20, R82.10, R82, R81.20 |
| OS | Windows |

## Symptoms

- * VPN Client connection is stuck at 47% and the connection window becomes unresponsive.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181452/connection_stuck202309061609511.png)  

* The TracSrvWrapper service might be stuck or restarted automatically and the vpn client will becomes responsive again after the re-connection.  

* The user needs to use some kind of USB security key or software on the problematic PC and there are some certificates installed under the current user's **Certificate Stores > Personal**.  

* We could find the trac.log stops recording after \[**CryptoApiTypeHandler::FillProvidersList: enter...**\].

  ```
  
  [ 2828 3416][23 Jun 13:41:37][] fwCAPIToken_imp::AddCertifiedKeyToHolder: Entering. prov name: , container name: (01F96550, fwCAPIToken_imp)
  [ 2828 3416][23 Jun 13:41:37][] fwCAPIToken_imp::AddCertifiedKeyToHolder: enter ... m_machineCtx is 0, m_SmartCard is 0
  [ 2828 3416][23 Jun 13:41:37][] CryptoApiTypeHandler::getCryptoApiType: enter...
  [ 2828 3416][23 Jun 13:41:37][] CryptoApiTypeHandler::FillProvidersList: enter...
  [ 2828 3416][23 Jun 13:41:37][] COM_Initializer::initialize_COM_if_needed: COM is not initialized -> about to CoInitializeEx
  [ 2828 3416][23 Jun 13:41:37][] COM_Initializer::initialize_COM_if_needed: CoInitializeEx done OK.
  [ 2828 2832][23 Jun 13:41:58][TracService] service_ctrl_ex: Called with ctrl_code 4
  [ 2828 2832][23 Jun 13:41:58][TracService] service_ctrl_ex: Called with ctrl_code 4
  [ 2828 2832][23 Jun 13:42:59][TracService] service_ctrl_ex: Called with ctrl_code 4
  [ 2828 2832][23 Jun 13:45:02][TracService] service_ctrl_ex: Called with ctrl_code 4
  [ 2828 2832][23 Jun 13:45:02][TracService] service_ctrl_ex: Called with ctrl_code 4
  [ 8904 9352][23 Jun 13:45:18][TracService] ServiceMain: Entered service's main entry point (Check Point Endpoint Security)
  [ 8904 9352][23 Jun 13:45:18][cpservice] service_report_status_to_scm: Reporting start pending
  [ 8904 9352][23 Jun 13:45:18][TracService] IsDisabledInEps: failed to read mode from registry
  [ 8904 9352][23 Jun 13:45:18][TracService]
  
  [ 8904 9352][23 Jun 13:45:18][TracService] -------------------------------------------------------------
  [ 8904 9352][23 Jun 13:45:18][TracService] SERVICE WAS STARTED
  [ 8904 9352][23 Jun 13:45:18][TracService] -------------------------------------------------------------
  ```

## Cause

The user has 3rd-party Cryptographic Service Provider (CSP) dynamic-link library (DLL) installed on the Windows PC in order to use some kind of USB security key or software for certificate based authentication.  

During the connection phase of the Check Point VPN client, we need to enumerate providers on the system and read a property (if it's a Legacy or CNG provider) if there is any certificate installed under Certificate Stores \> Personal. The Windows system will try to get CSPs context by calling CryptAcquireContext function, but the 3rd-party CSP doesn't process such call correctly.   

From the crash dump of TracSrvWrapper service, we could see that the 3rd-party CSP just presents a message box for such call and this is the reason that why the VPN client gets stuck.  

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content