Hi it's a Powerconenct 7048 but i was looking for a general solution - ie if you have multiple routing interfaces how do you (or "do you need to" or "should you") have SSL certificates on each interface so that if it is scanned as part of a penetration test, it doesnt show up as having an SSL vulnerability (ie a self-signed certificate). Thanks

did a request on the switch and input the common name as the IP address i was SSh'd onto (in-band VLAN interface) and the rest of the details like country,location etc. Copied the request and pasted into our internal CA server and generated a certificate. OPened that and copied the string back into the SSH session after doing crypto cert 1 import and voila - that VLAN interface now presents a correctly configured certificate. Now i run my Nessus scan against that router's VLAN interface IPs and they all still report no certificates - except that one interface i just certified

So how do i make that certificate apply to the switch interfaces globally? An alias is the only way i could think but don't see how to do that.

My main quetion though is - is this normal practise? What does everyone else do? I had expected there to be more info out there than there is if this is standard operational config

i'll give this a try but it would seem its going to have to be an ACL since enabling SSH and HTTPS for the OOB interface requires that SSH and HTTPS must be enabled globally. Which seems a bit counterintuitive. Even although its only actually accessible via that interface, all the other routing interfaces must, by definition of a router, be exposed to the rest of the network and will always show as having no certificate in a nessus scan. I'm wondering if this just isn't actually a problem other than potentially a false positive.Thanks Daniel. I'll let you know how i get on