Bring Your Own Certificate (BYOC)

While Check Point WAF SaaS offers managed public SSL/TLS certificates signed by Let’s Encrypt, you may choose to use your own certificate and private key—ideal for compliance needs or existing certificate infrastructure.

Your private key is end-to-end encrypted during upload, ensuring complete confidentiality and security.

To configure HTTPS traffic with your own certificates, follow the steps below:

Step 1: Upload Certificate and Private Key

1. In the Infinity Portal, navigate to Policy → Profiles.

2. Select the Check Point WAF SaaS profile linked to your asset.

3. For each domain listed, click on it and:

   • Upload the public certificate (PEM format)

   • Upload the private key

   • Ensure the certificate includes the full chain

   • Extra attributes or text outside the PEM block are not allowed

This process must be repeated for each domain, e.g., www.myapp.com and api.myapp.com.

Step 2: Connect your domain to WAF SaaS

Before performing this stage, disable any existing AWS CloudFront configuration for your website's address if you have any.

Once the environment is ready, a CNAME value will be generated for your domain (this may take up to 30 minutes).

1. In your DNS provider’s configuration, replace the existing CNAME record with the new value provided by CloudGuard.

Once DNS records have propagated, your domain’s traffic will flow through WAF SaaS and be securely routed to your internal web server.

Step 3: Allow WAF SaaS to Access Your Origin Server

To ensure smooth traffic flow between WAF SaaS and your internal web server:

1. Allow incoming traffic from the IP addresses provided in the WAF SaaS deployment form.

2. Do not remove existing access rules until:

   • 72 hours have passed (to allow full DNS propagation), and

   • You have confirmed successful traffic flow through WAF SaaS.

If the origin was previously publicly accessible, restrict access to only WAF SaaS IPs after DNS switchover. If you were using another reverse proxy, consider removing its IPs from the access list after confirming the switch.

Step 4: Test access to your site

After completing the above steps:

• Confirm that the website is reachable over HTTPS.

• Verify that traffic is flowing through WAF SaaS (you can check headers or logs in the Infinity Portal).

• Double-check that your origin server is no longer publicly accessible (unless intentionally exposed).

Make sure you have not left a publicly exposed domain in your previous environment!

Reusing an Uploaded Certificate

Instead of uploading a new certificate for every domain, select My certificates in a domain's Certificates & Domain Management panel to open Select Certificate — a list of certificates you've already uploaded, showing each one's name, type (Specific/Wildcard), and expiration date. From here you can select an existing certificate to attach to this domain, upload a new one, or delete a certificate you no longer need.

Switching Certificate Types

You can switch a domain from BYOC to a Check Point-managed certificate (or vice versa) at any time, with no downtime — the previous certificate stays active until the new one validates.

Renewal — Important

Unlike Check Point-managed certificates, BYOC certificates are not auto-renewed. As a certificate approaches expiration, the portal displays a live countdown warning (e.g. "This certificate will not be auto-renewed. Please renew it within the next N days."). Renew and re-upload your certificate before it expires to avoid a validation failure or downtime.