[mcnallym]

I think you can possibly use an internal Microsoft CA, if you have an Account Unit license, as the Check Point needs to be able to verify the CRL list.

I believe that seen something about RSA-Keon in the forums but not done any of that myself.