What is a guideline for managing local certificates on AOS-CX switches?

When installing a local certificate on an AOS-CX switch that has been signed by a Certificate Authority (CA), the switch must be able to verify the certificate's authenticity. This is achieved by establishing a chain of trust. The administrator must first install the CA's root certificate (and any intermediate certificates) into a Trust Anchor (TA) profile. This TA profile acts as the switch's repository of trusted CAs, allowing it to validate the local certificate signed by that CA. This step is a prerequisite for successfully installing and using a CA-signed local certificate for services like HTTPS or 802.1X.

A. AOS-CX allows different certificates to be assigned to different applications (e.g., HTTPS, captive portal, RadSec), so using the same one is not a requirement.
B. AOS-CX switches fully support CA-signed certificates, which are the recommended best practice for security in production environments, not just self-signed ones.
D. OCSP is a protocol for checking certificate revocation status, not for simplifying certificate enrollment. Protocols like SCEP or EST are used for enrollment.

- ArubaOS-CX 10.11 Security Guide, "Public Key Infrastructure (PKI)" chapter, Page 10. The guide states, "Before you can use a CA-signed certificate, you must create a trust anchor (TA) profile that contains the root CA certificate of the CA that signed the certificate."

- ArubaOS-CX 10.11 Security Guide, "Applying a certificate to an application" section, Page 23. This section shows commands to apply different certificates to different applications like https-server and captive-portal.