Creating a generic signed cert for all UFs is what I did.  Our techsec policy doesn't require mutual TLS, so creating a single, valid cert for all UFs works a treat.  You'll want to stop your UF's from listening on external interfaces if your security team is going to port-scan, though, as the cert will come back as not matching the hostname and therefore a security emergency. (Not really, but with TechSec, what isn't an emergency?)  I droped the cert into a common app to all UFs and updated the cert path as well.  ... View more