Check Point HTTPS Inspection

Firewall and VPN

Renews inbound HTTPS Inspection certificates and the separately authorized outbound CA through the Management API.

What happens

The appliance connects to Check Point HTTPS Inspection through Management API on port 443.
Discovery reads rules, certificate objects and gateway policy. The package imports the certificate, chain and key as a separate object.
Inbound switches one rule’s certificate; outbound switches the default CA only with CHECKPOINT_OUTBOUND_CA_AUTHORIZED=true. The package publishes and installs the relevant policy. If it fails: With CHECKPOINT_PROBE_HOST set: if selected traffic worked before and fails afterwards, the package restores its own switch while that selection is still current.
Verification reads the published rule or default CA and gateway revisions. CHECKPOINT_PROBE_HOST adds a traffic probe; without it the result reports configuration verification.

Connection: The package runs on the appliance, which connects over HTTPS to Management API, port 443. No agent is installed.
Service ports: 443
You need: A Management API administrator or API key and appliance 0.4.45 or later or a relay. Select the policy, rule and gateways from discovery.
Platform: R81.20 and later, API 1.9–2.2; outbound CA from R82 / API 2
Actions: Discovery, Installation, Verification, Rollback
Packages: checkpoint-api
Note: Rollback uses retained state and restores only a still-current switch. Previous certificate objects remain. Coordinate other policy writers because the API has no compare-and-set.
Gateway and management portals and ICA/SIC are inventory only. The outbound role never changes client trust; clients must trust the new CA.