topic Re: SSL certificate RSA key is less than 2048 - Pen test in Unleashed

SSL certificate RSA key is less than 2048 - Pen test

MWSS — Tue, 25 Jul 2023 15:20:22 GMT

Hello, in a recent pen test the following was discovered for the Ruckus Unleashed master AP

SSL Certificate Chain Contains RSA Keys Less Than 2048 bits

"At least one of the X.509 certificates sent by the remote host has a
key that is shorter than 2048 bits. According to industry standards
set by the Certification Authority/Browser (CA/B) Forum, certificates
issued after January 1, 2014 must be at least 2048 bits.

I can see in the unleashed console that under the Administration > Certificate options I can change this option:
Re-generate private key of a specific key length to 2048.

The ruckus is using a self signed cert. If I click the option for 2048 and regenerate, will this update the self signed cert and cause no other impact but restarted the APs?

thanks

Re: SSL certificate RSA key is less than 2048 - Pen test

sanjay_kumar — Wed, 26 Jul 2023 08:22:29 GMT

Hi @MWSS
Could you please confirm the Unleashed version and the AP model you are using?

Re: SSL certificate RSA key is less than 2048 - Pen test

MWSS — Wed, 26 Jul 2023 08:26:21 GMT

Hi,

We're currently running 200.13.3.1.319 and they're R650s

Re: SSL certificate RSA key is less than 2048 - Pen test

sanjay_kumar — Wed, 26 Jul 2023 08:35:23 GMT

Hi @MWSS
Can you upgrade to 200.14.6.1.199 and let me know if you still face the same issue

Re: SSL certificate RSA key is less than 2048 - Pen test

MWSS — Wed, 26 Jul 2023 09:07:40 GMT

is the default 2048 in 200.14.6.1.199 ?

Re: SSL certificate RSA key is less than 2048 - Pen test

MWSS — Thu, 27 Jul 2023 08:45:12 GMT

Just checking you can confirm this Sanjay

Re: SSL certificate RSA key is less than 2048 - Pen test

sanjay_kumar — Fri, 28 Jul 2023 02:20:54 GMT

Hi @MWSS
I'm checking on this.

Re: SSL certificate RSA key is less than 2048 - Pen test

sanjay_kumar — Thu, 03 Aug 2023 02:29:10 GMT

Hi @MWSS

The option to regenerate private key under Administration > Certificate >> Advanced >> Re-Generate Private Key of a Specific Key Length: 2048

Should solve your issue. It will re-generate a new cert of the master AP which has RSA key length to 2048.

Re: SSL certificate RSA key is less than 2048 - Pen test

MWSS — Mon, 14 Aug 2023 07:50:43 GMT

thank you, this causes no impact apart from a reboot I presume?

Re: SSL certificate RSA key is less than 2048 - Pen test

sanjay_kumar — Mon, 14 Aug 2023 08:08:19 GMT

Hi @MWSS
Yes that is correct.