! Include deny statements up front for any protocols/ports/IP addresses that
!-- should not be impacted by CoPP
! Include permit statements for the protocols/ports that will be governed by CoPP
access-list 100 permit tcp any any eq 443
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature.
!
class-map match-all drop-SSL-class
match access-group 100
!
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
!
policy-map drop-SSL-policy
class drop-SSL-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device.
!
control-plane
service-policy input drop-SSL-policy

policy-map drop-SSL-policy
class drop-SSL-class
police 32000 1500 1500 conform-action drop exceed-action drop

access-list 101 permit tcp host host port 443
access-list 101 deny tcp any any port 443

Cisco
-----

cisco-sa-20070522-SSL：Multiple Vulnerabilities in Cisco IOS While
Processing SSL Packets