> Source: [sk183123](https://support.checkpoint.com/results/sk/sk183123)

# sk183123 - The Security Gateway does not load the renewed IPSec VPN Certificate which causes VPN traffic interruption

| Property | Value |
|----------|-------|
| Solution ID | sk183123 |
| Date Created | 2025-06-13 |
| Last Modified | 2026-07-29 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20 |

## Symptoms

- * Site to Site VPN tunnels go down unexpectedly and this error is printed in the VPND debug log which matches sk164840:  

  `[vpnd 15619 4092663712]@HOSTNAME[DATETIME][tunnel] proposalListFromIkeProps: transL->translst doesn't contain elements`  
  `[vpnd 15619 4092663712]@HOSTNAME[DATETIME][tunnel] MMProcess1: ERROR: Cannot build a proposal for GW`  
  `[vpnd 15619 4092663712]@HOSTNAME[DATETIME] GetCommunityByID: community ID [6] : COMMUNITY_NAME`  

* The IPSec VPN certificate is renewed and valid according to checking under the Security Gateway/Cluster object properties.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk183123/ipsec_cert202503031426171.png)
* The VPND debug shows that the Security Gateway is still using the old IPsec VPN certificate which was revoked during the check of the Management Server state.  

  **vpnd.elg:**   
  `[vpnd 15619 4092663712]@HOSTNAME[DATETIME]`  
  `X509 Certificate Version 3`  
  `refCount: 2`  
  `Serial Number: XXXXX`  
  `Issuer: O=MGMT-NAME..quwm3t`  
  `Subject: CN=GW-NMAE VPN Certificate,O=MGMT-NAME..quwm3t`  
  Not valid before: Mon Jun 27 09:36:33 2022 Local Time  
  `Not valid after: Sun Jun 27 09:36:33 2027 Local Time`  

  **Certificate status:**   
  `[Expert@MGMT-NAME:0]# cpca_client lscert -ser XXXXX`  
  `Operation succeeded. rc=0.`  
  `1 certs found. `

  `Subject = CN=GW-NMAE VPN Certificate,O=MGMT-NAME..quwm3t`  
  `Status = `**Revoked**`Kind = IKE Serial = XXXXX DP = 4`  
  `Not_Before: Sun Jun 26 21:36:33 2022 Not_After: Sat Jun 26 21:36:33 2027`

## Cause

The Security Gateway fails to automatically update its IPSec VPN certificate following renewal, continuing to use the expired certificate.   

<br />

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 99

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, please collect [CPinfo files](https://support.checkpoint.com/results/sk/sk92739) from the Security Management Server and Security Gateways involved in the case.  

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).  

The immediate **workaround** is available:  

Run the following command to restart the VPND process on the Security Gateway which will update the IPSec VPN certificate immediately.  

`[Expert@HOSTNAME:0] # fw kill vpnd`

Note: Make sure to restart the vpnd process on all members in the Maestro environment.  

If the above command does not show the updated VPN certificate, a reboot is required.  

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content