Generating a Centralized Root CA Certificate

  1. Go to Settings > Privacy/Security.
  2. In the Central HTTPS Inspection Root CA section, click Generate Certificate.
  3. Do one of these:
    • To generate a CA certificate issued by Check Point, click Generate CA Certificate.
      The system generates a certificate valid for one year from the generation date, as shown in Expiration date.
      Note:

      Check Point recommends you renew the CA certificate at least two weeks before the expiration date. To renew the CA certificate, see Appendix E - Renewing a CA Certificate.

    • To use a self-signed or a third-party CA certificate, click Upload CA Certificate.
      1. In the pop-up window, upload the certificate.
        Note:

        For the Transport Layer Security (TLS) certificate to be valid:

        • The certificate must have a lifecycle of at least 30 days and not longer than 390 days.

        • The certificate must be valid for more than 30 days from the time it is uploaded to the Mobile Security Administrator Portal.

      2. Enter the certificate password.
      3. Click Verify.
      4. If there are no errors, click Add.
  4. If you have generated a CA certificate by Check Point, click Download Certificate.

    The system downloads the certificate to your computer.

  5. Upload the new certificate to the UEM.

    For more information, see CA Certificate Deployment Using the UEM section for the relevant UEM in Mobile Security Integration Guide.

  6. To revoke the certificate, click Revoke Certificate.
    Important:

    Revoking the centralized certificate will remove it from all policies that use it.

To apply the centralized CA certificate to multiple policies in your tenant, go to HTTPS Settings in Network Protection settings.