Support Importing CA-Signed Certificates

Options
Zyxel_Tina
Zyxel_Tina Posts: 925 image  Zyxel Employee
Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
in Switch Ideas

Currently, Zyxel switch only supports self-signed certificates.

Therefore, user @ihr would like to request adding support for importing CA-signed certificates that include an intermediate CA chain (PKCS12 format) into the switch.

This suggestion originated from the post found here:

Import certificate - ERROR: Import custom CA fail — Zyxel Community

If you have a similar use case or requirement, please show your support by leaving a comment or voting for it.

Zyxel Tina

3
Up Down
3 votes

Active · Last Updated

Comments

  • xyno
    xyno Posts: 4 image  Freshman Member
    First Comment Friend Collector
    Options

    ​Hi @Zyxel_Tina ,
    ​You have my absolute full support for this! I have just voted.
    ​I recently submitted a similar feature request specifically for the new GS1200-8 v3, but this is clearly a necessity across the entire Zyxel switch lineup.

    https://community.zyxel.com/en/discussion/32751/allow-custom-https-ssl-certificate-upload-for-gs1200-8-v3


    ​In my environment (and many Prosumer/SMB setups), we use systems like OPNsense as an Internal Certificate Authority and Let's Encrypt for local domain management. Being forced to use hardcoded self-signed certificates completely breaks the Zero-Trust architecture and results in constant browser warnings.


    ​Supporting the PKCS12 format (to include the intermediate chain) is a brilliant approach. If the WebUI could support either PKCS12 or the standard PEM format (.crt + .key), it would perfectly solve the issue for everyone.


    ​Please urge the development team to implement this feature, and please consider rolling it out to the entry-level Web-Managed series (like the GS1200 v3) as well, not just the high-end models. Thank you for listening to the community!

  • PeterUK
    PeterUK Posts: 4,573 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited July 24
    Options

    I'm not sure what you mean by  "Zyxel switch only supports self-signed certificates" ? the XS1930 can do CA-Signed Certificates

    Screenshot 2026-07-24 160647.png
  • PeterUK
    PeterUK Posts: 4,573 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited July 24
    Options

    However some of Zyxel older or lesser model switches don't support this

    The problem is what with this roll on to shorter expiry date certificates the ACME would also be needed. And that makes for some trouble because let say you have a firewall and switch on one WAN IP to do the ACME requires port 80 so how are you going to do that. well there is a way using nginx so that it proxy different domains like

    firewall.bridgemode.network proxy 192.168.0.1

    switch.bridgemode.network proxy 192.168.0.254

    So that as traffic comes in it maps to the LAN side of the firewall or switch IP to do the ACME verifying.

Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）