> Source: [sk183800](https://support.checkpoint.com/results/sk/sk183800)

# sk183800 - HTTPS Inspection fails to inspect traffic to internal sites

| Property | Value |
|----------|-------|
| Solution ID | sk183800 |
| Date Created | 2025-08-22 |
| Last Modified | 2026-09-10 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * HTTPS traffic to internal sites is blocked or fails during HTTPS Inspection.
* When accessing internal servers that use self-signed certificates, these errors are printed in the WSTLSD process debug:  
  `Certificate Key Usage is invalid: issuer is not allowed to sign certificates`  
  `sendValidationLog: Called.sendValidationLog: log, Invalid Key Usage, Wrong certificate key usage.`  
* The issue occurs specifically when using Fail-Close and Hold Mode in Application Control (APPI) and URL Filtering (URLF).

## Cause

Self-signed certificates used by internal servers without standard Key Usage or Basic Constraints extensions that Check Point's HTTPS Inspection expects. The Security Gateway treats these certificates as invalid and blocks the connection, even though they are legitimate for internal use.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 44
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 126
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 166

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

**How to use this hotfix** :

1. Install the fix.
2. Add the related server's CA to the gateway's trusted CA list using [sk179944](https://support.checkpoint.com/results/sk/sk179944) Section 2.B (Import the missing root CA certificate manually).
3. Enable the registry keys after installing the fix.
4. Reconfigure the process.
5. Clear the hostname cache.

The feature "*Create ability for configuration to treat certificates without key usage or basic constraints extensions* " was developed to meet specific customer requirements.  

**How to enable the feature** :  

1.Enable the registers:   
`ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_WRONG_KEY_USAGE 1`  
`ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_BASIC_CONSTRAINTS 1`  

2.Reconfigure the process:  
`fw fetch local `  

3.Clear the SNI cache to apply the new validation:  
`fw tab -t cptls_host_name_cache -x -y`  

**How to disable the feature** :  

1.Disable the register keys:   
`ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_WRONG_KEY_USAGE 0`  
`ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_BASIC_CONSTRAINTS 0`  

2.Reconfigure the process:  
`fw fetch local `  

3.Clear the SNI cache:  
`fw tab -t cptls_host_name_cache -x -y`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content