> Source: [sk98655](https://support.checkpoint.com/results/sk/sk98655)

# sk98655 - Check Point or Windows signatures update fails when HTTPS Inspection enabled on Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk98655 |
| Date Created | 2014-02-20 |
| Last Modified | 2024-12-27 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Check Point signatures update fails when HTTPS Inspection is enabled on Security Gateway.  

* Connection attempt to Check Point server over HTTPS with `curl` command fails:  

  `
  #curl https://updates.checkpoint.com/WebService/services/DownloadMetaDataService`  
  `
  curl: (60) SSL certificate problem, verify that the CA cert is OK. `  
  `
  Details:`  
  `
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed`  
  `
  More details here: http://curl.haxx.se/docs/sslcerts.html
  `  

* Connection attempt to Check Point server over HTTPS with `curl --insecure` command succeeds.

## Solution

### HTTPS Inspection Bypass List

To function correctly, some well-known update services must be bypassed by HTTPS Inspection.

When the option "`Bypass HTTPS inspection of traffic to well-known software update services`" is **enabled** in SmartConsole (this is the default in R80.10 and higher), the HTTPS Inspection does not apply to the update services listed below (this is the *canonical* list). Because the domains for these update services may change, the links to these update services are dynamically updated on the Security Gateway.

List of update services that HTTPS Inspection bypasses:

* Check Point updates

* Microsoft updates

* VMware updates

* Mozilla updates

* Java updates

* Adobe updates

### Configuration Instructions

Configuration Instructions for R82 and higher
> Show / Hide this section  
> 1. Connect with SmartConsole to the Security Management Server / Domain Management Server.
>
> 2. From the left navigation panel, click **Security Policies**.
>
> 3. In the top panel, click **HTTPS Inspection**.
>
> 4. In the bottom panel **HTTPS Inspection Tools** , click **Advanced Settings**.
>
> 5. In the left tree, click **Bypass Allow Lists**.
>
> 6. In the section **Well-known Update Services** , select the option "**Bypass traffic to well-known software update services**".
>
> 7. Click **OK**.
>
> 8. Install the Access Control Policy.

Configuration Instructions for R80.40, R81, R81.10, and R81.20
> Show / Hide this section  
> 1. Connect with SmartConsole to the Security Management Server / Domain Management Server.
>
> 2. From the left navigation panel, click **Manage \& Settings**.
>
> 3. Click **Blades**.
>
> 4. In the **HTTPS Inspection** section, click **Configure in SmartDashboard**.
>
> 5. In the left panel, click the **HTTPS Validation** page.
>
> 6. At the bottom of the page, select the option "**Bypass HTTPS inspection of traffic to well known software update services (list is dynamically updated)"**.
>
>    Example:
>
>    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk98655/sk98655_R80_40202103011210251.png)
> 7. Save the changes - click the the **File** menu \> click **Save**.
>
> 8. Close SmartDashboard.
>
> 9. In SmartConsole, install the Access Control policy on the relevant Security Gateway / Cluster object.

Configuration Instructions for R80, R80.10, R80.20, and R80.30
> Show / Hide this section  
> 1. Connect with SmartConsole to the Security Management Server / Domain Management Server.
>
> 2. From the left navigation panel, click **Manage \& Settings**.
>
> 3. Click **Blades**.
>
> 4. In the **HTTPS Inspection** section, click **Configure in SmartDashboard**
>
> 5. At the top, click the **Application \& URL Filtering** tab.
>
> 6. In the left panel, expand **Advanced**.
>
> 7. Expand **HTTPS Inspection**.
>
> 8. Click the **Policy** page.
>
> 9. At the bottom of the page, select the option "**Bypass HTTPS inspection of traffic to well known software update services (list is dynamically updated)"**.
>
>    Example:
>
>    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk98655/sk98655_SmartDashboard.png)
> 10. Save the changes - click the the **File** menu \> click **Save**.
>
> 11. Close SmartDashboard.
>
> 12. In SmartConsole, install the Access Control policy on the relevant Security Gateway / Cluster object.

Configuration Instructions for R77.30 and lower
> Show / Hide this section  
> 1. Connect with SmartDashboard to the Security Management Server / Domain Management Server.
>
> 2. At the top, click the **Application \& URL Filtering** tab.
>
> 3. In the left panel, expand **Advanced**.
>
> 4. Expand **HTTPS Inspection**.
>
> 5. Click the **Policy** page.
>
> 6. At the bottom of the page, select the option "**Bypass HTTPS inspection of traffic to well known software update services (list is dynamically updated)**".
>
>    Example:
>
>    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk98655/sk98655_SmartDashboard.png)
> 7. Save the changes - click the the **File** menu \> click **Save**.
>
> 8. Install the Firewall policy on the relevant Security Gateway / Cluster object.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content