An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management.
Concretely, the configured certificate+key is used as-is for HTTPS. For SSH the device extracts and reuses the raw RSA key from the certificate (modulus N, public exponent e, private exponent d)
My question is: Is this "only" bad practice or a potential vulnerability?
Follow-up: What arguments can be used when opening a case with the vendor?