revoking Check Point administrator certificates - Revision history

Nighthawk: /* solution */

2014-07-25T17:35:42Z

‎solution

Nighthawk: /* solution */

2014-07-25T17:35:02Z

‎solution

Nighthawk: /* solution */

2014-07-25T17:34:37Z

‎solution

Nighthawk: /* problem description */

2014-07-25T17:24:32Z

‎problem description

Nighthawk: /* problem description */

2014-07-25T17:24:24Z

‎problem description

Nighthawk at 17:12, 25 July 2014

2014-07-25T17:12:46Z

Nighthawk: Created page with " == problem description == Sometimes the need arises to revoke a user's certificate via CLI. One such situation is one where an administrator account was deleted without fir..."

2014-07-25T16:54:45Z

Created page with " == problem description == Sometimes the need arises to revoke a user's certificate via CLI. One such situation is one where an administrator account was deleted without fir..."

New page

== problem description ==

Sometimes the need arises to revoke a user's certificate via CLI. One such situation is one where an administrator account was deleted without first revoking the certificate in the GUI. This will delete the user but leave the user certificate behind. If you try to recreate a user with the same name and generate a certificate, the certificate generation will fail.

== solution ==

1. verify the user account does NOT currently exist...

[Expert@P1server]# cpmiquerybin attr "mdsdb" pv1_administrators "type='pv1_administrator'" -a __name__ | grep -i johnsmith

no return value from above, so account non-existent

2. list current certs for user

[Expert@P1server]# '''cpca_client lscert | grep -A 2 -i johnsmith'''
Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9
Status = Revoked Kind = SIC Serial = 26247 DP = 0
Not_Before: Mon Dec 9 20:30:28 2013 Not_After: Sun Dec 9 20:30:28 2018
--
Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9
'''Status = Valid''' Kind = SIC Serial = 47765 DP = 0
Not_Before: Fri Mar 28 04:57:09 2014 Not_After: Thu Mar 28 04:57:09 2019
--

3. revoke valid certs by referencing the CNs from above

[Expert@P1server]# '''cpca_client revoke_cert -n "CN=johnsmith,OU=users,O=P1server..rsyqv9"'''
Certificate was revoked successfully

4. verify all certs have a status of revoked

[Expert@P1server]# cpca_client lscert | grep -A 2 -i johnsmith
Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9
'''Status = Revoked''' Kind = SIC Serial = 26247 DP = 0
Not_Before: Mon Dec 9 20:30:28 2013 Not_After: Sun Dec 9 20:30:28 2018
--
Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9
'''Status = Revoked''' Kind = SIC Serial = 47765 DP = 0
Not_Before: Fri Mar 28 04:57:09 2014 Not_After: Thu Mar 28 04:57:09 2019
--

done

@@ Line 13: / Line 13: @@
 . list current certs for user
-  [Expert@P1server]# '''cpca_client lscert | grep -A 2 -i  johnsmith''' | grep -C 1 -i valid
+  [Expert@P1server]# '''cpca_client lscert | grep -A 2 -i  johnsmith | grep -C 1 -i valid '''
   --
   Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9
@@ Line 28: / Line 28: @@
 . verify all certs have a status of revoked
-  [Expert@P1server]# cpca_client lscert | grep -A 2 -i johnsmith  | grep -C 1 -i valid
+  [Expert@P1server]# '''cpca_client lscert | grep -A 2 -i johnsmith  | grep -C 1 -i valid'''
   --
   Subject = CN=johnsmith,OU=users,O=P1server..rsyqv9

@@ Line 2: / Line 2: @@
 == problem description ==
 versions: Check Point R65 - R75 (guessing)
 products: reported on Provider-1, but could be relavant for a Smartcenter / Smart-1

@@ Line 23: / Line 23: @@
 . revoke valid certs by referencing the CNs from above
-[Expert@P1server]# '''cpca_client revoke_cert -n "CN=johnsmith,OU=users,O=P1server..rsyqv9"'''
+ [Expert@P1server]# '''cpca_client revoke_cert -n "CN=johnsmith,OU=users,O=P1server..rsyqv9"'''
   Certificate was revoked successfully

@@ Line 1: / Line 1: @@
 == problem description ==
-Sometimes the need arises to revoke a user's certificate via CLI.  One such situation is one where an administrator account was deleted without first revoking the certificate in the GUI.  This will delete the user but leave the user certificate behind.  If you try to recreate a user with the same name and generate a certificate, the certificate generation will fail.
+Sometimes the need arises to revoke a user's certificate via CLI.  One such situation is one where an administrator account was deleted without first revoking the certificate in the GUI.  This will delete the user but leave the user certificate behind.  If you try to recreate a user with the same name and generate a certificate, sometimes the certificate generation will fail.  An exact error message is not documented here.
-−
 == solution ==