> Source: [sk181681](https://support.checkpoint.com/results/sk/sk181681)

# sk181681 - "DynamicID authentication failed" after an upgrade / SMS provider certificate change

| Property | Value |
|----------|-------|
| Solution ID | sk181681 |
| Date Created | 2023-11-27 |
| Last Modified | 2025-02-10 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Two-factor authentication of end users with DynamicID fails after an upgrade or after the SMS service provider changed a certificate.  

* Debug from the `CVPND` daemon shows the Security Gateway's certificate is expired before the certificate's expiration date:

  ```
  
  
  [PID][DATE TIME][AU] DynamicIDSession::setState new_state -103 client_code 60 server_code 0 log_msg SSL certificate problem: certificate has expired
  [PID][DATE TIME][AsyncCurl] set_params_for_callback - Warning: (0x9fb4898) finished with result code (-3) - (SSL certificate problem: certificate has expired)
  ```

  Or that there is an issue with self signed certificate in the certificate chaing

  ```
  
  [AsyncCurl] set_params_for_callback - Warning: (0x91ba530) finished with result code (-3) - (SSL certificate problem: self signed certificate in certificate chain)
  ```

* Output of the `curl_cli` command on the Security Gateway shows that the certificate verification fails:

  ```
  
  ERR_lib_error_string: SSL routines
   ERR_func_error_string: tls_process_server_certificate
   ERR_reason_error_string: certificate verify failed
   ERR_error_string: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
  * SSL certificate problem: unable to get local issuer certificate
  * Closing connection 0
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: https://curl.haxx.se/docs/sslcerts.html
  ```

## Cause

The connection between the SMS provider and the Security Gateway fails because the Security Gateway does not have the correct / new SSL Certificate or the SSL certificate is blacklisted.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content