FAQs

How to generate a CSR and install a certificate on a Check Point VPN appliance

Updated on August 14, 2026

Overview

By the end of this article you will have a signed SSL certificate installed and active on a Check Point Virtual Private Network (VPN) gateway, ready for remote user connections. The article first defines what a Check Point VPN appliance is, then covers four phases in order: adding the Sectigo Intermediate Certificate Authority (CA) to SmartDashboard so the gateway trusts the issuer, generating a Certificate Signing Request (CSR) with a correct Distinguished Name (DN), submitting the CSR to Sectigo and installing the signed certificate, and finally enabling VPN client login and pushing the policy. Terms introduced along the way include the Common Name (CN) and Subject Alternative Name (SAN) fields that identify your domain, and SSL Network Extender (SNX), the browser-based client that uses the installed certificate.

What is a Check Point VPN appliance?

A Check Point VPN appliance is a Check Point security gateway configured to terminate encrypted remote-access and site-to-site VPN connections for an organization. It is administered through SmartDashboard, the management console used to define gateway objects, trusted Certificate Authorities (CAs), and security policy. Because remote users connect to the gateway over SSL, the appliance needs a publicly trusted SSL certificate that matches the hostname users connect to — which is why a CSR must be generated on the appliance and submitted to a CA such as Sectigo.

Prerequisites

Administrator access to Check Point SmartDashboard with permission to edit gateway objects and Trusted CAs.
The Sectigo Intermediate Certificate Authority (CA) file (IntermediateCA.crt), available from the Sectigo portal.
The fully qualified domain name that remote users will connect to, for example vpn.exampledomain.com.
An active Sectigo account with permission to submit a Certificate Signing Request (CSR).

Step 1 — Add the Sectigo Intermediate CA to SmartDashboard

This step makes the Check Point gateway trust the Certificate Authority (CA) that will sign your certificate. Complete it before generating the Certificate Signing Request (CSR), because the CSR wizard asks you to select an enrolling CA.

In SmartDashboard, right-click Trusted CAs, then select New CA > Subordinate.
In the Certificate Authority Properties window, open the General tab and enter a name, for example Sectigo_Intermediate.
Open the OPSEC PKI tab. OPSEC PKI is the Check Point tab used to import Public Key Infrastructure (PKI) certificate files.
Click Get, then select the IntermediateCA.crt file provided by Sectigo.
Click OK to complete the import.

The new Certificate Authority now appears under Trusted CAs in SmartDashboard.

Step 2 — Generate the CSR on the VPN gateway

This step creates the Certificate Signing Request (CSR) and the matching private key on the Check Point Virtual Private Network (VPN) gateway.

In SmartDashboard, open the Device Properties for your VPN gateway.
Navigate to IPSec VPN, then click Add under certificates.
In the Certificate Properties window, enter a Certificate Nickname, for example VPN.exampledomain.com, and under CA to Enroll From select the Sectigo Intermediate Certificate Authority (CA) added in Step 1.
Click Generate. When prompted to generate the certificate, select Yes.
In the Generate Certificate Request dialog, complete the Distinguished Name (DN) — the structured identity of the certificate — using this format: CN=Domain Name, OU=Department, O=Organization, L=Locality, ST=State, C=Country.
Optional: click Define Alternate Names to add Subject Alternative Names (SANs) if the certificate must cover more than one hostname.
Click OK.

Step 3 — Retrieve the CSR and submit it to Sectigo

This step copies the generated Certificate Signing Request (CSR) out of SmartDashboard so it can be submitted for signing.

After generation, click View to open the Certificate Request View.
Click Copy to Clipboard to copy the CSR, and click Save to File to keep a local copy.
Open the saved .csr file in any plain text editor and copy the entire content, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.
Paste the copied content into the certificate request form in the Sectigo portal and submit it.
Complete Sectigo validation. Once validation finishes, Sectigo issues the signed certificate and sends it to you as a .crt file.

Step 4 — Install the signed certificate

This step installs the signed SSL certificate returned by Sectigo onto the Check Point Virtual Private Network (VPN) gateway.

Open the VPN gateway's Device Properties in SmartDashboard.
Go to IPSec VPN, then click Complete next to the certificate entry created in Step 2.
Upload the signed .crt file received from Sectigo.
Click OK to finish the installation.

Step 5 — Enable VPN client login (optional)

Complete this step only if remote users will connect through SSL Network Extender (SNX), the browser-based Check Point Virtual Private Network (VPN) client.

In IPSec VPN settings, select VPN Client Login.
Under SSL Network Extender, choose the installed certificate using Select by Nickname.
Click OK.

Step 6 — Install the policy

Changes made in SmartDashboard take effect only after the policy is pushed to the gateway.

Click Install Policy in SmartDashboard.
Define your Installation Targets, for example the gateway or cluster members.
Click Install to push the new certificate and configuration.

How to verify the certificate was installed successfully

Open the VPN gateway's Device Properties in SmartDashboard and confirm the certificate status shows as complete and issued by the Sectigo Intermediate Certificate Authority (CA), with the expected expiry date. Then browse to the VPN portal address from an external network and confirm the browser shows a valid, trusted SSL certificate with no name-mismatch warning.

Troubleshooting

Issue: The browser reports a certificate name mismatch when users connect to the VPN portal.

Cause: The Common Name (CN) or Subject Alternative Name (SAN) on the certificate does not match the hostname users type.

Solution: Generate a new Certificate Signing Request (CSR) with the correct CN, add every alternate hostname under Define Alternate Names, and reinstall the reissued certificate.

Issue: The signed certificate cannot be uploaded, or the file is in .p7b format.

Cause: Check Point expects a .crt file in Privacy Enhanced Mail (PEM) or DER encoding, not a PKCS#7 bundle.

Solution: Convert the file using OpenSSL, for example openssl pkcs7 -print_certs -in certificate.p7b -out certificate.crt, then upload the converted .crt file.

Issue: The certificate installs but remote users still see an untrusted connection.

Cause: The Sectigo Intermediate Certificate Authority (CA) was not imported, so the chain is incomplete.

Solution: Import the intermediate as described in Step 1, then reinstall the policy as described in Step 6.

Tips and best practices

Confirm the Common Name (CN) or Subject Alternative Name (SAN) matches the domain users will connect to before submitting the Certificate Signing Request (CSR).
Back up the private key and the CSR before submitting the request to Sectigo.
Record the certificate expiry date and schedule renewal in advance to avoid an outage for remote users.

Frequently asked questions

What is a CSR?

A Certificate Signing Request (CSR) is an encoded block of text generated on the device that contains your public key and identity details, such as the Common Name (CN) and organization. You submit it to a Certificate Authority (CA) such as Sectigo, which signs it and returns an SSL certificate.

How do I generate a CSR on a Check Point VPN appliance?

In SmartDashboard, open the VPN gateway's Device Properties, go to IPSec VPN, click Add under certificates, select the enrolling Certificate Authority (CA), click Generate, and complete the Distinguished Name (DN) fields.

Do I need to add the Sectigo intermediate certificate before generating the CSR?

Yes. The Check Point Certificate Signing Request (CSR) wizard requires you to choose a Certificate Authority (CA) to enroll from, so the Sectigo intermediate must already exist under Trusted CAs.

What should I do if the certificate arrives in .p7b format?

Convert it to a .crt file using OpenSSL before uploading, because Check Point does not accept a PKCS#7 bundle directly.

Can I use one certificate for more than one VPN hostname?

Yes. Add each additional hostname as a Subject Alternative Name (SAN) using Define Alternate Names when you generate the Certificate Signing Request (CSR).