cpca_client [-d] revoke_cert [-p <CA port number>] -n "CN=<Common Name>" -s <Certificate Serial Number>

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

-p <CA port number>

Optional. Specifies the TCP port on the Security Management Server or Domain Management Server, which is used to connect to the Certificate Authority.

The default TCP port number is 18209.

-n "CN=<Common Name>"

Specifies the certificate CN.

To get the CN, run the cpca_client lscert command and examine the text that you see between the "Subject = " and the ",O=...".

Example:

From this output:

Subject = CN=VS1 VPN Certificate,O=MyDomain_Server.checkpoint.com.s6t98x

Status = Valid Kind = IKE Serial = 27214 DP = 1

Not_Before: Wed Apr 11 17:26:02 2018 Not_After: Tue Apr 11 17:26:02 2023

you get this syntax:

-n "CN=VS1 VPN Certificate

Note - You can use the parameter '-n' only, or together with the parameter '-s'.

-s <Certificate Serial Number>

Specifies the certificate serial number.

To see the serial number, run the cpca_client lscert command.

Note - You can use the parameter '-s' only, or together with the parameter '-n'.

[Expert@MGMT:0]# cpca_client lscert

Subject = CN=VS1 VPN Certificate,O=MyDomain_Server.checkpoint.com.s6t98x

Status = Valid Kind = IKE Serial = 27214 DP = 1

Not_Before: Wed Apr 11 17:26:02 2018 Not_After: Tue Apr 11 17:26:02 2023

[Expert@MGMT:0]#

[Expert@MGMT:0]# cpca_client -d revoke_cert -n "CN=VS1 VPN Certificate"

Certificate was revoked successfully

[Expert@MGMT:0]#

[Expert@MGMT:0]# cpca_client lscert

Subject = CN=VS1 VPN Certificate,O=MyDomain_Server.checkpoint.com.s6t98x

Status = Valid Kind = IKE Serial = 27214 DP = 1

Not_Before: Wed Apr 11 17:26:02 2018 Not_After: Tue Apr 11 17:26:02 2023

[Expert@MGMT:0]#

[Expert@MGMT:0]# cpca_client -d revoke_cert -s 27214

Certificate was revoked successfully

[Expert@MGMT:0]#