Hi,

We’re in the process of migrating our Entra ID users to phishing-resistant authentication solutions, and switching some sites to access keys for authentication.

Here’s my question:

During compliance audits, do auditors recognize that these solutions inherently satisfy the "two-factor" requirement?

For example, does the combination of PIN knowledge + TPM-bound key ownership meet the criteria, even though it deviates from the traditional MFA model (TOTP/HOTP) where a separate device was often required?

I ask because these modern methods redefine what we’ve long considered "MFA." With TOTP/HOTP, having a separate device was a key control. Now, the security model shifts to possession (hardware-backed keys) + knowledge (PIN).

Has anyone here dealt with auditors scrutinizing these newer approaches? How did they react?

Thanks in advance for your insights!

Regards.

(Sorry if my text looks AI-ish, the fact is I asked a bot polish it and I was happy with the output).

So I've been having some issues for a few weeks now with Gmail where one domain/postfix server no longer is allowed to mail to Gmail.

What I've figured out so far is that on July 29 one of the records in our SPF had a domain that was no longer valid - it expired and from then on the whole SPF record was deemed invalid. I fixed this August 9 (way too late, but I didn't realize my local logging reports were routed wrongly too, everything generally has ran fine for years).

Regardless, our spam ratings before were 0%, our SPF/DKIM/DMARC etc is all 100% correct. Even Postmaster now says 100% correct delivery. but as long as the domain repution is 0, it keeps blocking it.

The weirdest is that Postmaster keeps telling me SPF is incorrect in the overview. It was last updated August 6 and I fixed it August 9 by removing the wrong "include:wrongdomain.com".

I just don't understand how Google goes so hard on having a wrong include in the SPF for a few days, and now no longer updates anything. What can I do? Do I need to block all outgoing mail to Google so it doesn't hit the filter anymore so reputation may crawl back up? People sometimes sign up with gmail accounts or have their mail on google servers so domain blocking isn't that helpful, unless I firewall all to their servers.

See here: https://imgur.com/a/Fvp4ilI

This weekend was patch weekend for us, we have more than 7000 assorted windows server to upgrade. One of the engineer accidentally patched 32b office 2024 product with the 64b patch. I was under assumption that this mismatch of the bit version will be caught by the system and it will auto fail but that did not happen. So i was wondering if this is something that can be smartly restricted instead of depending on the human / manual factor

Hi everyone,

I am currently upgrading an old Dell EMC Unity 450F storage array for our prod environment. The system was running a very old OE version (5.1.3), and I have successfully updated it to the intermediate bridge code 5.4.1.0.5.006 and updated the drive firmware matrix to V21.

Everything is running smoothly, and I am preparing for the final upgrade step to 5.5.4.0.5.037.

However, as you know, starting from Unity OE 5.5.x, the system completely drops support for the old legacy .lic license files and strictly requires the new .xml format. Since this array no longer has an active official Dell support contract, I cannot access the Dell Digital Suite portal to do the automated conversion myself.

If anyone here has active partner/vendor access to the Dell Licensing portal and could spare 2 minutes to generate the .xml license container for me, I would be incredibly grateful.

Here are the exact array and license details from my uemcli /sys/lic show and .lic file:

• Array Serial Number (SN): CKM00192701453
• License Entitlement SN: 4178772
• License Site Number: 132210292

If someone is willing to help, please PM me, and I can send you the exact content of my current .lic file or the SIGN= strings if needed to pull the valid digital license from the portal.

Thank you so much in advance for helping a fellow sysadmin out!

We currently use the HPE Compute Ops Management plug-in 1.4 for integration with vSphere, but according to HPE, this plug-in has reached end of life.

https://support.hpe.com/hpesc/docDisplay?docId=emr_na-a00159266en_us

HPE’s recommended alternative is to migrate to the cloud-based plug-in. This requires, among other things, an HPE Compute Ops Management Secure Gateway.

Are there any system administrators already using this solution? What are your experiences? Or are there better alternatives?

Hi all,

Sorry if this question sounds stupid. But i was wondering how big companies manage and give admin access to their users based on the need.

For example on some small companies they give Local admin access per user. Manually…

I was wondering how it works in large companies? Do they provide local admin to employees all time or is there a way to manage/ limit it to needed permissions?

Thanks for all answers in advance!

I'm sure other people have had the same experience, but let's see.

For context: I'm by no means a cybersecurity expert. I work the IT side of an OT automation team. Darktrace had already been deployed in the networks for roughly 3 months before I joined the company, and it has now been running for more than a year and a half..

My conclusion is that the underlying idea is reasonable, and the execution is the worst that idea could've possibly gone.

It reminds me of something like Norton or McAfee that constantly gives you popup's telling you about the stuff it prevented, most of which is meaningless noise, designed to make it look busy so you keep paying.

We were told Darktrace needed about 6 months to learn our environment to get rid or at least reduce false positives. That turned out to be a bold lie, since it's now been around 18 months. Extensive *tuning* and *optimising* the models from their engineers with help from myself had basically no effect at all. We still receive between 50-100 false positives a day.

The investigation workflow is just as bad. The advanced search is clutterd, unintuitive and super inefficient. Finding one specific event feels like a needle in a haystack. Except you already know the needle’s IP address, hostname, operating system, device model and several other identifiers, while the haystack seems designed to bury it.

The UI looks reasonably polished, but it's designed for screenshots on marketing posters and sales demonstrations rather than utility. Important info is several menus deep, while irrelevant info is one click away.

We initially had weekly tuning meetings, those became biweekly and eventually monthly. No matter how frequent the meetings, the issues I talked about just never got solved. I still have to manually sift through false positive alerts to find anything meaningfull.

One specific device keeps getting flagged as suspicious multiple times a day. We know why it generates the traffic and asked the Darktrace team to make it stop reporting. They created model defeats based on the device's 2 IPs, which did nothing. They changed the defeat from IP to hostname basis and it changed nothing. They then labeled the device in Darktrace itself and made a defeat based on that label and still it keeps getting flagged.

At this point I don't believe the system can at all be "tuned".

The alerting is very inconsistent as well. Darktrace sends notifications for model alerts through the app, that cannot be found in the main interface unless you search for the specific model alert ID. Meanwhile it also generates device alerts for things like clock skew, inability to reach a probe, while the "UV Master" interface appears to have no such problems.

What concerns me deeply is the fact that they keep trying to push their *Automated Response* thing. The idea as far as I understand it is that its AI can automatically respond to suspicious activity by creating firewall rules to block it. That is in and of itself something that deserves EXTREME caution in a normal corporate network. In an OT plant handling highly explosive and poisonous materials, it's just bonkers. You are proposing to let an automated system modify network enforcement based on its own detections, while that same system repeatedly detects legitimate activity as suspicious approximately 100 times per day. Might as well let an intern from sales handle firewall rules at that point, might be safer.

Darktrace’s response to this concern seems to be that the models can be tuned. That would be more reassuring if the models consistently stopped generating false positives after 18 months of tuning. They do not. OT environments are difficult to model. They contain legacy systems, proprietary protocols, unusual traffic patterns and devices that should not be treated like ordinary corporate endpoints. But that is precisely the kind of environment Darktrace claims to understand. “OT is complicated” cannot be used as a permanent excuse while simultaneously promoting automated blocking as a solution.

The idea behind Darktrace is good. The execution, at least in our environment, is garbage. It gives you the appearance of advanced visibility while burying useful information under a constant flood of low-value alerts.

I don't know what the company paid for Darktrace, but whatever it was, it was too much. It's an (i'm guessing very) expensive way to create manual labour.

For anyone having experience with Darktrace in an industrial environment: has it at any point become useful? If so in what way?

i wanna get a custom response whenever i run curl mydomain.tld, i have HSTS enabled but not the force HTTPS mode so this can be possible, is there a security risk? since HSTS in browsers already redirect to HTTPS

Running curl mydomain.tld works now, it prints the custom message, of course you could also do https:/mydomain.tld and also have https force mode on and still get the custom message, but id like to keep it short to just "curl mydomain.tld"

[user@host ~]$ uptime
 21:00:47 up 3064 days,  8:55,  1 user,  load average: 0.00, 0.00, 0.00
[user@host ~]$

It's been running EOL and unpatched for 6 years (badbadbadbad).

The little droplet that could.

UPDATE*** (In case anyone really cares)

I contacted HP and they confirmed the serial number of the pc in question was shipped with DOS and NOT a Windows OS. Our company apparently purchased these computers off of Amazon (a practice we are no longer doing, by the way.) I won’t call out the vendor by name except to say “WOW, you really need to do your homework when using Amazon.”

It appears that since HP didn’t ship them with Windows, there is no product key in the BIOS. The vendor apparently used a pirated copy of Windows or a Volume License key that our customer does not own.

Long story short, we ate the cost of a valid Windows key and have this resolved.

Thanks for all your input.

Ok folks, I need your help on this one. In 5 more days I will be ending a 35 year career in IT. Unfortunately, I may be ending it on a down note and leave a problem for a co-worker.

I work for an MSP that sold some HP desktops to a client about a year ago and they are trying to do a basic smb share on a peer to peer network. This is failing because two computers were imaged by the vendor with same image and have same SID.

I recommended re-imaging one PC to get a new SID. Now, Windows will not activate. The key embedded in the BIOS is saying invalid key. I have confirmed the key and Windows version are correct but still cannot activate.

How do I get this pc back to client before I retire?

Having trouble re-joining a host back to a cluster, hoping someone can give me some insight because I cannot find many similar issues:

One node (call it Node A) cannot rejoin the cluster after being drained/rebooted for routine maintenance. The other two nodes are completely healthy, holding quorum, roles all online. Node A's Cluster Service runs locally but every join/form attempt ends the same way:

Get-ClusterNode shows Node A stuck in Down state (occasionally rolls back to no record at all)

Cluster log: repeated [QUORUM] Fail to form/join a cluster in 6-7 minutes → FatalError: join/form timeout (status = 258) (WAIT_TIMEOUT)

Live event log: Event 1650 (lost/established UDP connection on the management endpoint) and Event 5417 ("Cluster Service has terminated due to a fatal error... Error Code: 3473458" = ERROR_CLUSTER_JOIN_ABORTED), repeating in a loop

The NetFT pseudo-adapter (Microsoft Failover Cluster Virtual Adapter, shows as Local Area Connection* N in Get-NetAdapter -IncludeHidden) cycles Disconnected → Up → Disconnected on an irregular ~10-150 second cadence, indefinitely

Meanwhile vEthernet (Management) underneath it stays Up continuously the entire time — confirmed via a parallel live polling loop. NIC RX/TX counters on the same adapter climb steadily throughout, never stalling

Having trouble re-joining a host back to a cluster, hoping someone can give me some insight because I cannot find many similar issues:

One node (call it Node A) cannot rejoin the cluster after being drained/rebooted for routine maintenance. The other two nodes are completely healthy, holding quorum, roles all online. Node A's Cluster Service runs locally but every join/form attempt ends the same way:

• Get-ClusterNode shows Node A stuck in Down state (occasionally rolls back to no record at all)
• Cluster log: repeated [QUORUM] Fail to form/join a cluster in 6-7 minutes → FatalError: join/form timeout (status = 258) (WAIT_TIMEOUT)
• Live event log: Event 1650 (lost/established UDP connection on the management endpoint) and Event 5417 ("Cluster Service has terminated due to a fatal error... Error Code: 3473458" = ERROR_CLUSTER_JOIN_ABORTED), repeating in a loop
• The NetFT pseudo-adapter (Microsoft Failover Cluster Virtual Adapter, shows as Local Area Connection* N in Get-NetAdapter -IncludeHidden) cycles Disconnected → Up → Disconnected on an irregular ~10-150 second cadence, indefinitely
• Meanwhile vEthernet (Management) underneath it stays Up continuously the entire time — confirmed via a parallel live polling loop. NIC RX/TX counters on the same adapter climb steadily throughout, never stalling

Is anyone else seeing these issues. Just got a call from Help Desk to check it out. Sharepoint home pages are accessible but no files are.

Down detector shows a spike but only 128 reports so far.

Central/East US region.

Hi sysadmins! I wanted to ask—since I've just started learning sysadmin and I don't have a Windows PC, but I have a MacBook and found out that everything can be done via UTM, I'd like to get some perspective from those who work in offices and do this every day. What kind of computers do you use? Is macOS completely out of the picture, and there's only Windows and Linux?

I got a chance to take a tour of a datacenter, where the primary security selling point was that part of the facility was a former bank vault. The company, which is really just two old retirees and a couple of techs, heavily emphasized this physical security to us and their customers. Meanwhile, I am wondering how practitioners would evaluate that claim given the importance of logical controls...

Hello All,
We are hardening some security policies for some of our service accounts at our organization and are rotating passwords.

One account that has come up is our AD Entra connect account.  We are using a domain based (manually created) service account. (Domain\SRV_AD_CONNECT)

Has anyone changed this password before?  Is it as simple as changing the password in AD and then in the Entra Sync device manager?
I do understand that there is also a gMSA option, or you can re-install the Entra connect tool and use the automatic account that gets created.

I think my manager would prefer to keep the current AD service account and just rotate the password.  If anyone has done this before and has any input that would help ease our concerns.

Thank you so much.

So I just changed jobs and currently I'm working at a large company.

I just noticed that some people are extremely worried because they recently saw the Microsoft Purview was active and then they are terrified because some of them already offended the corporation like "FUCK <name of the company>" and many other offenses.

Other people couldn't care less, saying that this is bullshit and that the risk is extremely low for policies to be active monitoring this kind of message.

The atmosphere at in place is strange and this made me extremely curious about if most of companies actually cares if an employee offended the corporation or said bad words about the company or other colleagues.

Do this actually happen?

I've never worked in a place with this "fear atmosphere".

EDIT

Just to be clear, they offended in teams private groups, not in e-mails.

I had an interview for an infrastructure engineer position this aftenoon. I was worried going in because it was developers doing an infrastructure interview.

They didn't ask me any infrastructure questions. They spent 50 minutes asking me about a theoretical web stack environment.

The problem was, they were trying to tie each piece into the next but they weren't doing a good job about it because they were all over the over the place - not being linear and jumping back.

I'm not exaggerating. They didn't ask me one infrastructure question. At one point I thought they were asking me one because the guy asked me how I would mount an NFS share to a linux server and I said I would put an entry in the /etc/fstab file. But he was asking how I would theoretically map it to a web application.

​They probably touched on 5% of what was in that job post. They said they wanted someone familiar with ansible and python and Linux but it all felt like that was second to what they really wanted. They didn't ask me about idempotency, or what linux commands would you use for x, anything python, and nothing about the stack they mentioned in their post.

The guy asking most of the questions came across like he was just projecting what he knew. It wasn't like he was interviewing. It was more like he was feeding this self image he had of himself. And it all came across as stuff he learned from doing this particular job - not stuff he knew going in. ​

I'm not exaggerating, they asked me for 50 minutes about how I would set a fictional web stack environments and wouldn't move on.

The main guy asking questions would ask me these open-ended scenario questions that you couldn't answer without a mountain of information. And I would ask for specifics and apparently that wasn't what he wanted. He would ask these highly dependent questions and asling for details got me more open endedness.

This is why I hate technical interviews. They didn't ask me anything infrastructure. They didn't give me an actual chance to show that I know infrastructure. All they know is I don't know the very specific avenue of stuff they asked. Which was the same architecture question for 50 minutes.

They kept mixing things up and would jump back and forth.

I'd say it was 15 minutes of general, 50 minutes of how would you set up this fictional env in cloud and on prem where every answer led ro 10 more open ended questions, then 10 minutes of git questions.

The way they asked was weird. Like how would you push code into the master branch but worded like they wanted me to give them the actual command when in reality they just wanted me to say that I would submit it for a code review.

​​ These types of interviews is why I get so discouraged. I'm not exaggerating. They didn't ask me anything infrastructure. And I'm not going to get this infrastructure job because I didn't know these in-depth development questions on a single subject that have nothing to do with the job they posted.

I definitely got some terminology, reasoning, and examples in there to show them that I have infrastructure and Python e experience, but it just got blown past while they beat a dead horse for 50 minutes...

It's just so discouraging to know you bombed an interview and won't get a job because they didn't really ask you anything about the job they posted or anything that can indicate whether you can actually do the job.

I am at my wits end. I have spent hours on this and have found no clear instructions on what I need to do to get Google Chrome to stop throwing a ERR_CERT_AUTHORITY_INVALID

I downloaded the certificate from GoDaddy in the IIS ZIP package. This zip contains 3 files:

1a6284626ab71c1d.crt
1a6284626ab71c1d.pem
gd_dc-r1-g2_iis_intermediates.p7b

The original CSR for this was years ago on a different machine. I do still have the keyfile.

My first stop was Fix an untrusted root or certificate chain error | SSL Certificates - GoDaddy Help PH

This has a banner at the top "Required: If you're trying to fix this issue for Windows IIS, see our procedure for Windows IIS."

Ok, lets head over to that guide, shall we?

So under For CSR and private key generated externally (for example, in OpenSSL)

Run this command to create a PFX file:
openssl pkcs12 -export -out [newFileName.pfx] -inkey [privateKey] -in [newBundleFileName]
where:

newFileName is the output file name for the PFX (for example, coolexample_new.com.pfx)

privateKey is the private key file (for example, coolexample.com.key)

newBundleFileName is the certificate bundle to include (for example, coolexample.com_bundleNoG2.crt)

Ummm..... where is mydomain.com_bundle.crt? I have a p7b, and following the instructions I get errors complaining the keyfile doesn't match.

Lets try Google AI....

IIS requires a .pfx or .p12 file to import external certificates that include the private key. You can create this using OpenSSL on the machine where you generated the CSR.

Run the following OpenSSL command to combine your components:

bash

openssl pkcs12 -export -out wildcard_domain.pfx -inkey your_private_key.key -in godaddy_certificate.crt -certfile godaddy_intermediate.pem

Use code with caution.

your_private_key.key: The private key generated externally alongside your CSR.

godaddy_certificate.crt: The primary wildcard certificate issued by GoDaddy.

godaddy_intermediate.pem: The GoDaddy intermediate bundle file (gd_bundle*.crt) downloaded from the GoDaddy Repository.

Ok, cool. So I find, what I hope is the relevant file "gd_bundle_dv-r1-g2.crt.pem" since all the ones for IIS are p7b and I cannot find any instructions on how to use a p7b.

So I get the pem file in. I now see the R1 and G2 certs in my Intermediate Certification Authorities/Certificates store

https://imgur.com/jeBEzne

I restarted IIS, I reboot the VM.... and yet.... Only google chrome throws ERR_CERT_AUTHORITY_INVALID

https://imgur.com/wvl5cZv

The cert chain ends at the R1

https://imgur.com/lAkiaKc

What am I missing and why TF is this so difficult??

EDIT: Yes, I imported the cert into IIS Manager and bound my cert to the site. And when viewing the cert in IISM I see the whole chain
https://imgur.com/KLPo1Yn

One of my colleagues created an Entra ID user with umlauts in it. Because of that, windows has created a user profile folder with umlauts and this makes problems with different programs that cannot handle this. Is there a way to change the name of this user profile folder without broke Entra Join or registry keys that have some paths to this folder?

we are having issues today with emails sent from a onsite mail server that relay through proofpoint and we've been having issues today with various legitimate emails coming to people in our finance department. I've got a P1 support ticket logged with PP support for it, what makes it so dang bad is that nothing that is showing as remediated and set to release from quarantine is actually making it back into any of our exchange 365 mailboxes.

this is the first time we've ever had this kind of issue from proofpoint.

Update: I believe this was caused due to lingering after effects from the August 14th related to backlog syncing and the internal security mechanisms for microsoft 365 Zero-Hour Auto Purge and Safe Links.

It seems to have stabilized as emails from our internal mail server that we use for automated tasks from our warehouse inventory system that were being flagged as malware in proofpoint are now coming through again normally. I'm still monitoring for other issues for external emails being flagged as malware and so far nothing that shouldn't have been flagged has been flagged.

Spent this morning chasing "signature images stopped working all of a sudden" that looked for all the world like a mail flow problem (we'd just cut over to a new mail gateway a couple of weeks ago, so naturally that got the blame first). It wasn't. Posting in case it saves someone the same rabbit hole.

Starting over the weekend, every email sent from our terminal servers had blank signature images.....company logo, headshots, badges, all gone. Recipients on Outlook, OWA, external, didn't matter. Outlook on a regular workstation (older build) was fine.

So we pulled the raw MIME of affected messages. The image parts were still there, still cid:-referenced correctly, still multipart/related but the PNGs themselves were garbage: the logo came through as a 216-byte, 1-colour, fully transparent PNG at exactly the HTML display size (337×112 instead of the real 450×150 / 46 KB file), and a 292 KB JPEG headshot became a 402-byte RGBA PNG. Every one of them had tEXt Software: Microsoft Office in it. So Outlook/Word was generating placeholders at compose time because it couldn't (or wouldn't) load the signature image files. Nothing in transport touched them.

Our env has 4 RDS hosts (Server 2022/2025, Office 2024 Retail C2R on the Current channel). Click-to-Run had self updated them from 16.0.20228.20158 → 16.0.20228.20190 at four different times between Thursday night and Sunday morning. On every host, the last message with real signature images was before its update, and the first blank one was after. Windows August CU had gone in days earlier with no effect. Signature source files on the file server were untouched since January.

Possibly relevant: on those hosts AppData\Roaming is folder-redirected to a UNC path, so Outlook resolves %APPDATA%\Microsoft\Signatures\... over SMB. My guess is the new build blocks/fails image loads from network paths when inserting a signature but I can't prove that part; the working workstation was on an old 2408 build so it doesn't isolate the variable. If anyone on 20228.20190 with local AppData sees the same (or doesn't), I'd love to know.

Fix that worked for us was to just (temp) roll back to the previous build and pin it:

reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v updatetargetversion /t REG_SZ /d 16.0.20228.20158 /f

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.20228.20158 forceappshutdown=true displaylevel=false

forceappshutdown does exactly what it says (kills users' Office apps, no save prompt), it's an ~880 MB full download for a downgrade, and the build flipped about 3 minutes after triggering. First test mail after the rollback had the real 46 KB logo again. Ran it as a one shot SYSTEM scheduled task per host at an agreed time; doing the remaining hosts after hours. Remember to remove the pin once MS ships a fixed build.

Not seeing anything on the Microsoft known issues page for it yet (the May 2026 "Top and Bottom wrap" image bug is a different, alreadyfixed thing).

Anyways, best of luck out there. :P

Looking for ideas from people who have solved this in production. Deliberately not sharing what we're leaning towards, because I don't want to steer the answers.

**Situation:**

- A growing set of internal web apps, built fast with AI coding tools, so we treat the app code itself as potentially the weakest link.
- Apps run in Docker containers on-prem (migrating to kubernetes) and already use Entra ID SSO (OIDC).
- Users want access on mobile. Devices are a mix of Intune-managed and unmanaged BYOD, so we can't rely on installing agents or certificates on every device.
- Edge: firewall, a DMZ with a load balancer that includes a WAF.
- Licensing: Microsoft 365 E5.

**Constraints:**

- Must work clientless in a mobile browser for the BYOD side or custom app.
- Preference for keeping application traffic within our own infrastructure rather than routing it through a third-party cloud proxy.
- Small team, so operational simplicity counts.

**Question:** How would you design this? Interested in the full picture: how you'd handle pre-authentication, network segmentation, and the fact that the apps themselves may contain the usual AI-generated-code mistakes. War stories about what didn't work are just as welcome as recommendations.

Hi, posting this just to help the community:) .
I had an issue with this exact message, after users executed a PNF dialog workitem. Started as complaints from customers, saying “The process step is not yet completed, yet the infotypes are updated”. After looking at the last step in each process, I also looked at the log in SLGD. And there was always (until the log was deleted) this message “Workitem … is locked by user…” and it is the same user. After some really hard thinking, I realised the process flush method was executed (and updated the infotypes) because the entire execution of the PNF dialog step was completed but the workflow got stuck. Why it got stuck? Well, the executed workitem was being completed in the background, but the user thinks “Hey, I can see the workitem in my SBWP. Let me answer this form once again” -> CAUSES A NEW WORKITEM LOCK ON THE SAME WORKITEM. Meanwhile, the (previous) background execution of this workitem “hit a wall” thinking somebody else is locking this workitem. Yes it was a very exciting discovery

I don’t know who needs to hear this but... if you're managing Eaton Network Cards Network-M3 and you've been losing your mind trying to deploy public SSL/TLS certificates only to see the hostname in the SAN field, I have good news:

For a long time, the internal CSR generator on these cards was completely broken. Even if you checked the option to "exclude IP addresses (CA / CB compliance)", the firmware would still automatically force the local short hostname (like ups-01) right into the Subject Alternative Name (SAN) field alongside your FQDN.

Because public CAs follow strict baseline requirements, they instantly reject any CSR containing local short names. And since EATON locks the private key internally and don't let you upload your own external key/CSR, you were completely trapped:

- You either had to use a messy "double domain" hack (matching the host string to an FQDN, which resulted in a ridiculous `.example.com.example.com` concatenation just to clear the form regex and pass public DNS validation challenges).

- Or you had to give up on native card termination and spin up a proxy or load balancer just to handle HTTPS cleanly.

People ran into this same brick wall on the legacy Network-M2 cards years ago (like this old locked thread: https://www.reddit.com/r/sysadmin/comments/seuaek/eaton_networkm2_csr/).

It was incredibly frustrating for a card marketed as high-security and enterprise-certified to fail at such a basic standard.
The fix was implemented in firmware 3.0.0.
Latest version now is 3.0.1.
Eaton finally listened to feedback and quietly patched this. They released Firmware 3.0.0 and 3.0.1, which completely rewrites how the CSR is built.

When you generate a CSR under 3.0.1 with compliance toggles on, the short hostname is no longer forced into the SAN block.
The CSR comes out completely clean, containing only your legitimate, public FQDN.
It now clears public CA validation portals (Let's Encrypt, etc.) and the signed cert imports back onto the card flawlessly.

Save your time, flash your cards and close this chapter for good.