> Source: [sk184793](https://support.checkpoint.com/results/sk/sk184793)

# sk184793 - Maestro Orchestrator Certificate and CRL validation fails from March 1, 2026

| Property | Value |
|----------|-------|
| Solution ID | sk184793 |
| Date Created | 2026-03-08 |
| Last Modified | 2026-03-08 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82.10, R82 |
| OS | Gaia |
| Platform | Maestro Orchestrator |

## Symptoms

- * Applying the configuration changes in Gaia Portal or Gaia Clish fails because of Rest Server issues on the remote Orchestrator.

  Example:

  `Orchestrator 1_2 has Rest Server issues.`  
  `
  If you apply the configuration now, it cannot be synchronized to that Orchestrator.`

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184793/image1202603081423561.png)
* Configuring the authentication with a remote Orchestrator fails because of REST issues.

  Example:

  `Orchestrator is known but cannot securely communicate.`  
  `
  Orchestrator can SSH but cannot REST.`

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184793/image2202603081431353.png)
* The HCP test "`Orchestrators REST server`" fails on the Orchestrators.

  `hcp -r "Orchestrators REST server"`

  Example:

  ```
  
  Test name                                         Status    Runtime (sec)
  ==========================================================================
  Orchestrators REST server.........................[ERROR]   0.xxxxx
  
  +---------------------------------------------------------------------
  |                                                              Results
  +---------------------------------------------------------------------
  |... ...
  |                                        Orchestrator/Connectivity/Orchestrators REST server
  | Result: ERROR
  |
  | Description: This test checks if this local and remote Orchestrators respond to REST requests
  |
  |
  | Finding:
  |
  | +-------------------------------------------------------------------------+
  | |                        Orchestrator REST Server                         |
  | +-----------------+-------------------------------------------------------+
  | | Orchestrator ID |                      Description                      |
  | +=================+=======================================================+
  | | 1_1             | The Orchestrator did not respond to the REST request. |
  | +-----------------+-------------------------------------------------------+
  | | 1_2             | The Orchestrator did not respond to the REST request. |
  | |                 | Skipping the remaining tests for this Orchestrator.   |
  | |                 | Client return code: 132                               |
  ... ...
  ```

* The Expert mode command "`smo_rest_util -c show-hostname -i 1_1`" on the Orchestrator returns:

  `Error occurred while running smo_rest_api_request_url(). Curl return code: 900, error: 'cpcrypto' failed validate the certificate (including CRL).`  
  `
  Check /var/log/smo_rest.log for more details.`

## Cause

In **R82 and R82.10,** there is an error in the date calculation logic used during validation of:

* X.509 certificates
* Certificate Revocation List (CRLs)

Starting **March 1, 2026,** newly generated certificates and CRLs are evaluated as **not yet valid** because of incorrect calculation of the *Not Before* timestamp.  

As a result:  

* Certificates and CRLs are considered valid only after up to 24 hours.
* Any operation requiring immediate certificate or CRL validation fails during this period.

<br />

**This issue is not related to the system clock, timezone, or NTP configuration.**

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content