Hi,
Recently, we conducted an network-wide audit scan. Most of the results of this audit were easy to figure out; however, one switch in particular - a WS-C2960S-48FPS-L running IOS 12.2(55r)SE - was found to have several certificate errors that seem to be something that should be found on a firewall. The only thing I could relate these to were my crypto key configuration, which I increased from 1024 bits to 2048, and enabled SSHv2. I'm not sure if there is anything else I can do. Does anyone have any ideas what these mean and what else might need to be done?
* Certificate Subject CN Does Not Match the Entity Name (certificate-common-name-mismatch)
* TLS/SSL Server Supports DES and IDEA Cipher Suites (ssl-des-ciphers)
* Untrusted TLS/SSL server X.509 certificate (tls-untrusted-ca)
* MD5-based Signature in TLS/SSL Server X.509 Certificate (tls-server-cert-sig-alg-md5)
* TLS/SSL Birthday attacks on 64-bit block ciphers (SWEET32) (ssl-cve-2016-2183-sweet32)
* TLS/SSL Server Supports RC4 Cipher Algorithms (CVE-2013-2566) (rc4-cve-2013-2566)
* TLS/SSL Server is enabling the BEAST attack (ssl-cve-2011-3389-beast)
* Self-signed TLS/SSL certificate (ssl-self-signed-certificate)
* TLS/SSL Server Supports SSLv3 (sslv3-supported)
* TLS/SSL Server Supports The Use of Static Key Ciphers (ssl-static-key-ciphers)
* Weak Cryptographic Key (weak-crypto-key)
* TLS/SSL Server Supports 3DES Cipher Suite (ssl-3des-ciphers)
* TLS/SSL Server Does Not Support Any Strong Cipher Algorithms (ssl-only-weak-ciphers)
