Custom SSL certificate

[Deleted member 19827]

Hi there


Model: RT-AC66U
Firmware:3.0.0.4.374.32 (Merlin build)

I have a question regarding custom ssl certificate for HTTPS connections. Is it possible to add my own certificate to my router permanently? If it is possible what steps are required to do so?

Many thanks in advance.


Regards DR_HAMMER

 

[PrivateJoker]

Hi there


Model: RT-AC66U
Firmware:3.0.0.4.374.32 (Merlin build)

I have a question regarding custom ssl certificate for HTTPS connections. Is it possible to add my own certificate to my router permanently? If it is possible what steps are required to do so?

Many thanks in advance.


Regards DR_HAMMER

I think there might be some confusion on what you are trying to do and how your router comes into play, at least for me there is confusion.

If you could give us some more details of what your goal is, this group can probably get you headed in the right direction.

 

[Deleted member 19827]

I'm sorry for the confusion. I hope this will clarify it.

I would like to replace the auto generated ssl certificate from the HTTPS webserver:

With a free signed certificate from https://www.startssl.com error messages like this would disappear:

I found something similar so far, but it doesn't seem to work: http://tomatousb.org/tut:use-ssl-certificate-for-wan-admin


Thanks a lot.

Regards
DR_HAMMER

 

[PrivateJoker]

A self signed certificate (or email only validated cert) will give that error 100% of the time because the certificate is saying "I'm Xyz website, trust me." The whole CA concept works because of the "web of trust" system where a certificate can say "I'm Xyz website, but you don't have to take my word for it, ask any of these other CAs you already know & trust."

To have a URL that is trusted widely by browsers (and not be giving warnings like in the URL you provided), well first I don't think you could get one behind a dynamic IP in a SOHO/home setup. I have one that's already paid for at my registrar but I've never used it because I don't have a domain I own somewhere that runs the seriously professional level server backend that that specific cert integrates with.

 

[RMerlin]

You can't purchase a certificate signed for an IP. It has to be for a CN within a domain name, with you proving you have ownership of that domain.

 

[PrivateJoker]

You can't purchase a certificate signed for an IP. It has to be for a CN within a domain name, with you proving you have ownership of that domain.

Oh mine is registered, in fact I am the master of my domain.



thx merlin, so ya - owning a domain and proving you own it (with usually a combination of paperwork and putting files on its server) is a good place to start.

 

[Deleted member 19827]

I do have all prerequirements like a domain. In apache2 I would just put the path of my certificates but I don't know how to configure this webserver.

The config file would look something like that:

http://www.startssl.com/?app=21

So is it really not possible to add custom certificates to this webserver of my router?

 

[RMerlin]

Officially, not. However there is still some leftover code from the Tomato days where the httpd daemon tries to use a certificate saved in the https_crt_file nvram var - no idea if that code is still working or is just dead code not used anywhere else. The code can be found in start_ssl() in router/httpd/httpd.c. Someone would need to take a look to see if it's working and/or usable.

 

[troycarpenter]

I found this on the web that worked for me:

https://gist.github.com/davidbalbert/6815258

However, note that until I rebooted the router, I got a "not found" error page. After rebooting, I got the green lock in my web browser and no annoying "Site not trusted" page.

 

[RMerlin]

I found this on the web that worked for me:

https://gist.github.com/davidbalbert/6815258

However, note that until I rebooted the router, I got a "not found" error page. After rebooting, I got the green lock in my web browser and no annoying "Site not trusted" page.

He's running httpd from /tmp/home/root, which won't work - httpd uses the current work directory for its web content.

The proper way would be to restart the httpd service rather than killing and running it from the shell.

service restart_httpd