Own X.509 certificates and keys is not working
Hi!
I needed a switch with more than six 10GBit RJ45 ports, so I bought two SX3832.
I operate both switches in stand-alone mode, without a controller. The initial setup worked. Unfortunately, I did not manage to use my own certificate and key for the https service.
On "SECURITY > Access Security > HTTPS Config" I selected my X.509 certificate and the private key. Then I pressed "save config".
But the server still uses its self signed RSA2048 certificate instead of my EC prime256v1 key/cert.
There is a ‘download cert/key’ button, but it is not documented anywhere. If I click on this buttons, a message appears for approx. 0.1 seconds which is then directly replaced by a message that the certificate could not be downloaded.
I even managed to break the htps server. So that only a reset of the switch helped.
My local CA and all other servers on my network are using prime256v1 keys and ecdsa-with-SHA256 certificate signatures.
At the moment I am really very frustrated :(
Ikarisan
Ikarisan wrote
@Clive_A Yes, both files are base64. For testing purpose I made a new test CA from scratch and generated a X.509 certificate and a keyfile. I have attached the files as a ZIP archive.This key cannot be uploaded either. Neither in Firefox nor in Chrome - tested both in private mode.
I extracted and compared both public parts:
openssl pkey -in testcert_key.pem -pubout -out pubkey_key.pem openssl x509 -in testcert.crt -pubkey -noout -out pubkey_crt.pem
They are the same.
Maybe someone can have a look and tell me what's wrong with the key.
====
What I mean by Cisco is that the upload to the switch is called a download. On Cisco Catalyst switches, you also have to click on “Download & Install” if you want to upload an update from the PC to the switch. I have always found this very confusing.
The team mentioned that you could try an RSA 4096 key and a SHA512 signature.
Can you try this pair?
@Clive_A Yes, both files are base64. For testing purpose I made a new test CA from scratch and generated a X.509 certificate and a keyfile. I have attached the files as a ZIP archive.This key cannot be uploaded either. Neither in Firefox nor in Chrome - tested both in private mode.
I extracted and compared both public parts:
openssl pkey -in testcert_key.pem -pubout -out pubkey_key.pem openssl x509 -in testcert.crt -pubkey -noout -out pubkey_crt.pem
They are the same.
Maybe someone can have a look and tell me what's wrong with the key.
====
What I mean by Cisco is that the upload to the switch is called a download. On Cisco Catalyst switches, you also have to click on “Download & Install” if you want to upload an update from the PC to the switch. I have always found this very confusing. 
Ikarisan wrote
@Clive_A Yes, both files are base64. For testing purpose I made a new test CA from scratch and generated a X.509 certificate and a keyfile. I have attached the files as a ZIP archive.This key cannot be uploaded either. Neither in Firefox nor in Chrome - tested both in private mode.
I extracted and compared both public parts:
openssl pkey -in testcert_key.pem -pubout -out pubkey_key.pem openssl x509 -in testcert.crt -pubkey -noout -out pubkey_crt.pem
They are the same.
Maybe someone can have a look and tell me what's wrong with the key.
====
What I mean by Cisco is that the upload to the switch is called a download. On Cisco Catalyst switches, you also have to click on “Download & Install” if you want to upload an update from the PC to the switch. I have always found this very confusing.
The team mentioned that you could try an RSA 4096 key and a SHA512 signature.
Can you try this pair?