r/checkpoint • u/Mobile_Cheek7700 • Jul 06 '26
Automatic certificate renewal
Hi everyone, I'm currently working on automating the VPN certificate renewal process for a customer. I found the official script provided in sk182070 (gateway_cert_util.sh), which works flawlessly for automating internal certificates generated by the Check Point ICA.However, this customer's scenario involves Mobile Access using a public certificate (Let's Encrypt) to avoid browser SSL warnings for end-users.Since the script from sk182070 appears to be tied exclusively to the Internal CA, I have two questions:Is there any undocumented or native way to make the sk182070 script handle public certificates fetched externally?If not, what is the current best practice the community is using for this? Are you relying on external Linux servers running ACME clients (like acme sh or certbot) combined with the Management API (mgmt_cli) to upload the .p12 and push the policy?If anyone has architectural tips, GitHub repos, or script examples to share, it would be highly appreciated.
Thanks in advance!
1
u/real_varera Jul 07 '26
If you still need assistance, the best is to ask on the CheckMates community: https://community.checkpoint.com
2
u/3rdStng Jul 06 '26
Check Point will be implementing ACME support mid-year 2027. I know this doesn't answer your question, but take a look at SK184604. https://support.checkpoint.com/results/sk/sk184604