cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.2.0-616
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.2.0-203
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

96
Views
0
Helpful
1
Replies

Cisco SMA and certificates

We use an SMA for a mail relay environment at a customer.

End users are accessing the HTTPS production interface for the SPAM quarantaine. Our operation team use the HTTPS management interface for daily operation. They are using the old web interface and using the ip address of the mngt interface, eg. https://10.a.b.c/.

 

We have installed one certificate on the box. The CN in this certificate matches with the hostname used by end-users, they see a valid certificate when accessing the spam quarantaine.

Our operation team sees the same certificate when they access the box and that certificate looks invalid, because they are using an ip address. Also the hostname associated with that interface doesn't match the CN of the certificate, thus switching to using the hostname doesn't solve that warning.

 

We are thinking about switching to the new web interface. To do that we must starting using hostnames on the management interface and using a valid certificate.  However I can't see how to use different certificates for the production interface and another one for the management interface.

 

Questions:

  • Can we use different certificates for the different interfaces/ports?
  • How do we configure that?

The only thing I can think of is specifying all possible hostnames in the SAN field of the certificate, but that exposes information of our environment (just a tiny bit) to the end-users of our customer.

 

Henk

 

1 REPLY 1
UdupiKrishna
Cisco Employee

Assigning different certificates to different interfaces is not possible on SMA. You got the approach right, a SAN certificate is the best approach here.

SMA allows different certificates to be used for different features but not interface.

Create
Recognize Your Peers
Content for Community-Ad