In order to manage a remote FTD w/ our FMC, we have the mgmt interfaces of an HA FTD cluster exposed to the Internet.
An auditor flagged it for having a self-signed cert, and there's probably a known or unknown vulnerability in the web server as well.
