> Source: [sk182484](https://support.checkpoint.com/results/sk/sk182484)

# sk182484 - Sites with 'Untrusted Certificate' are not matched by Custom Application, although SNI is detected 

| Property | Value |
|----------|-------|
| Solution ID | sk182484 |
| Date Created | 2024-07-09 |
| Last Modified | 2024-07-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Sites with 'Untrusted Certificate' do not match a rule with Custom Application, although the SNI in the client hello packet is detected, and you can see it in the log.

* The site has an Untrusted Certificate.

## Cause

LightSSL begins its process with the "client hello" packet by extracting the SNI and checking its validity. It maintains a cache of all previously validated SNIs.   

If The Security Gateway does not find an SNI in this cache, LightSSL waits to receive the certificate in the "server hello" packet.   
At this point, it performs a process known as probing, where it sends the certificate to the cloud for validation. When the certificate is confirmed as valid, the SNI is stored in LightSSL's cache for future connections.  

But if the SNI is stored in the cache as invalid or if a response from the Resource Advisor (RAD) process indicates that it is invalid, the SNI cannot be used further. In such cases, LightSSL uses the IP address directly instead of the SNI or URL.  

A common reason to mark an SNI as invalid is if its associated certificate is untrusted or if it is necessary to update the Certificate Authority (CA) list, which is a different issue.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content