Для того чтобы IOS мог проверить цепочку доверия при создании TLS/SSL
соединения для HTTPS необходимо установить X.509 CA сертификаты.
   
Наиболее простой путь, чтобы выяснить какие сертификаты необходимы - создать
TLS/SSL соединение к реальной системе:

   openssl s_client -showcerts -host dyn.dns.he.net -port 443

Вывод будет содержать данные об используемых сертификатах:

   CONNECTED(00000004)
   depth=0 /C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
   verify error:num=18:self signed certificate
   verify return:1
   depth=0 /C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
   verify return:1
   ---
   Certificate chain
    0 s:/C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
      i:/C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
   ---
   Server certificate
   -----BEGIN CERTIFICATE-----
   MIIFtjCCA54CCQC5vsyLyslykjANBgkqhkiG9w0BAQUFADCBnDELMAkGA1UEBhMC
   ...
   BBV9BRUtZTDY6D39PmUzJhs0GQuBlZHRWNM=
   -----END CERTIFICATE-----
   subject=/C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
   issuer=/C=US/ST=CA/L=Fremont/O=Hurricane Electric/OU=Secure Services/CN=dyn.dns.he.net/[email protected]
   ---

Далее, подключаемся к Cisco IOS, создаем новую точку доверия (CA trustpoint),
копируем в терминал и инcталлируем сертификат:

   $ ssh router
   login:
   password:
   
   cisico# conf term
   cisico(config)# crypto pki trustpoint TEST
   cisico(ca-trustpoint)# revocation-check none
   cisico(ca-trustpoint)# enrollment terminal pem
   cisico(ca-trustpoint)# exit
   cisico(config)# crypto pki authenticate TEST
   
   Enter the base 64 encoded CA certificate.
   End with a blank line or the word "quit" on a line by itself
   
   -----BEGIN CERTIFICATE-----
   MIIFtjCCA54CCQC5vsyLyslykjANBgkqhkiG9w0BAQUFADCBnDELMAkGA1UEBhMC
   ...
   BBV9BRUtZTDY6D39PmUzJhs0GQuBlZHRWNM=
   -----END CERTIFICATE-----
   quit
   Certificate has the following attributes:
          Fingerprint MD5: C9D04C92 B9A32172 B48C1110 054E3CF6
         Fingerprint SHA1: 3FDE18F7 33EA46C2 CE737287 01FCFFA0 FCF40D06
   
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.
   % Certificate successfully imported
   cisico(config)# exit
   
   cisico# write

Проверяем:

   cisico# show crypto pki trustpoints TEST

   Trustpoint TEST:
       Subject Name:
       [email protected]
       cn=dyn.dns.he.net
       ou=Secure Services
       o=Hurricane Electric
       l=Fremont
       st=CA
       c=US
             Serial Number (hex): 00B9BECC8BCAC97292
       Certificate configured.
   
   cisico# show crypto pki certificates TEST

   CA Certificate
     Status: Available
     Certificate Serial Number (hex): 00B9BECC8BCAC97292
     Certificate Usage: General Purpose
     Issuer:
       [email protected]
       cn=dyn.dns.he.net
       ou=Secure Services
       o=Hurricane Electric
       l=Fremont
       st=CA
       c=US
     Subject:
       [email protected]
       cn=dyn.dns.he.net
       ou=Secure Services
       o=Hurricane Electric
       l=Fremont
       st=CA
       c=US
     Validity Date:
       start date: 05:48:52 KLD Mar 26 2011
       end   date: 05:48:52 KLD Mar 23 2021
     Associated Trustpoints: TEST HE
     Storage: nvram:dnsadminhene#7272CA.cer

Теперь можно использовать HTTPS в DynDNS-методах Cisco IOS:

   ip ddns update method DDNS-METH-HE
    HTTP
     add https://host.somedomain.org:password123@\
       dyn.dns.he.net/nic/update?hostname=host.somedomain.org&myip=<a>
   
   interface Dialer0
    ip ddns update DDNS-METH-HE

Аналогично с другими поставщиками DynDNS-услуг.