Support Importing CA-Signed Certificates

Zyxel_Tina

Currently, Zyxel switch only supports self-signed certificates.

Therefore, user @ihr would like to request adding support for importing CA-signed certificates that include an intermediate CA chain (PKCS12 format) into the switch.

This suggestion originated from the post found here:

Import certificate - ERROR: Import custom CA fail — Zyxel Community

If you have a similar use case or requirement, please show your support by leaving a comment or voting for it.

xyno

​Hi @Zyxel_Tina ,
​You have my absolute full support for this! I have just voted.
​I recently submitted a similar feature request specifically for the new GS1200-8 v3, but this is clearly a necessity across the entire Zyxel switch lineup.

https://community.zyxel.com/en/discussion/32751/allow-custom-https-ssl-certificate-upload-for-gs1200-8-v3

​In my environment (and many Prosumer/SMB setups), we use systems like OPNsense as an Internal Certificate Authority and Let's Encrypt for local domain management. Being forced to use hardcoded self-signed certificates completely breaks the Zero-Trust architecture and results in constant browser warnings.

​Supporting the PKCS12 format (to include the intermediate chain) is a brilliant approach. If the WebUI could support either PKCS12 or the standard PEM format (.crt + .key), it would perfectly solve the issue for everyone.

​Please urge the development team to implement this feature, and please consider rolling it out to the entry-level Web-Managed series (like the GS1200 v3) as well, not just the high-end models. Thank you for listening to the community!

PeterUK

I'm not sure what you mean by  "Zyxel switch only supports self-signed certificates" ? the XS1930 can do CA-Signed Certificates

PeterUK

However some of Zyxel older or lesser model switches don't support this

The problem is what with this roll on to shorter expiry date certificates the ACME would also be needed. And that makes for some trouble because let say you have a firewall and switch on one WAN IP to do the ACME requires port 80 so how are you going to do that. well there is a way using nginx so that it proxy different domains like

firewall.bridgemode.network proxy 192.168.0.1

switch.bridgemode.network proxy 192.168.0.254

So that as traffic comes in it maps to the LAN side of the firewall or switch IP to do the ACME verifying.