> Source: [sk20905](https://support.checkpoint.com/results/sk/sk20905)

# sk20905 - How to create new SIC certificate on Security Management Server / Multi-Domain Security Management Server

| Property | Value |
|----------|-------|
| Solution ID | sk20905 |
| Date Created | 2003-07-02 |
| Last Modified | 2025-02-13 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |

## Cause



## Solution

Procedure
---------

**Note** : In Management HA configuration, implement the below steps on the **Primary** Security Management Server / Multi-Domain Management Server.

1. **Take a backup or snapshot of the machine ([sk108902](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902)).**   

2. Make sure that the SIC certificate is still valid:   

   On Security Management Server:  

   **`[Expert@HostName]# cpca_client lscert -stat Valid -kind SIC`**   

   On Multi-Domain Management Server:  

   **`[Expert@HostName]# mdsenv`
   `[Expert@HostName]# cpca_client lscert -stat Valid -kind SIC`**   

   If the output does not show a certificate for "`CN=cp_mgmt...`", then proceed with the steps below. Verify the CN format. It could be different than what is seen above.   

   If the output is "`Operation failed. rc=-1`" make sure the Management Server is Active as per [sk98432](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98432&partition=Advanced&product=Multi-Domain).  

3. Back up the existing certificate:   

   On Security Management Server:  

   **`[Expert@HostName]# cp $CPDIR/conf/sic_cert.p12{,_BACKUP}`**   

   On Multi-Domain Security Management Server:  

   **`[Expert@HostName]# mdsenv`
   `[Expert@HostName]# cp $CPDIR/conf/sic_cert.p12{,_BACKUP}`**   

4. Revoke the current SIC server certificate:  

   **`[Expert@HostName]# cpca_client revoke_cert -n "CN=cp_mgmt"`**   

   Note: In Management HA, the CN should be same as that present in HKLM_registry. In case the management server was acting as a secondary in the past, the CN would be of the format **CN=cp_mgmt_<OBJECT_NAME>**.  

   Note: In some scenarios, a code which runs periodically deletes the expired certificates from the CA database ($FWDIR/conf/InternalCA.db). The certificate will need to only be created.   

   To check the CN in registry:   
   **`[Expert@HostName]# grep MySICname $CPDIR/registry/HKLM_registry.data`**   

   On Security Management Server:  

   **`[Expert@HostName]# cpca_client revoke_cert -n "CN=cp_mgmt"`**   

   Note: In some scenarios, a code which runs periodically deletes the expired certificates from the CA database (`$FWDIR/conf/InternalCA.db`). The certificate will need to only be created.   

   On Multi-Domain Management Server:  

   **`[Expert@HostName]# mdsenv`** **`[Expert@HostName]# cpca_client revoke_cert -n "CN=<MySICname>"`**   

5. Create the new SIC server certificate:   

   On Security Management Server:  

   **`[Expert@HostName]# cpca_client create_cert -n "CN=cp_mgmt" -f $CPDIR/conf/sic_cert.p12`**   

   On Multi-Domain Security Management Server:  

   **`[Expert@HostName]# mdsenv`
   `[Expert@HostName]# cpca_client create_cert -n "CN=cp_mgmt" -f $CPDIR/conf/sic_cert.p12`**   
   **Note** : The certificate name is not a recommendation, it must be *sic_cert.p12*   

6. Restart Check Point services:   

   On Security Management Server:  

   **`[Expert@HostName]# cpstop`**   
   **`[Expert@HostName]# cpstart`**   

   On Multi-Domain Security Management Server:  

   **`[Expert@HostName]# mdsstop`
   `[Expert@HostName]# mdsstart`**   

   **Note** : This step is necessary to update the cache of processes running with the new SIC certificate details. On Multi-Domain Management Server, a full *mdsstop* is required. It is not enough to just restart the MDS level services with "*mdsstop -m* ".  

7. Connect to the Security Management Server / Multi-Domain Management Server with SmartConsole.

<br />

<br />

**Important:** In case you lose VPN connectivity (IPsec / SSL) and access to the Security Gateway's Gaia Portal, renew the VPN certificate also in the Security Gateway object properties \> "IPSec VPN" page.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content