Certificate Verification issue with RT-N66U

[programatix]

Hi,

I'm new with AsusWRT-Merlin and I'm encountering problem accessing HTTPS site from SSH.

When I tried executing WGET with HTTPS, I get, "ERROR: cannot verify ... certificate".

The same thing happen when I tried to use EASY_INSTALL. It would complain SSL: CERTIFICATE_VERIFY_FAILED.

Apparently from the search in the internet, I came to understand that I'm missing the CA certs in the router. However, I couldn't find the way to install or update them.

Any would be greatly appreciated. Thanks in advance.

 

[martinr]

I also await with interest an authoritative answer to your question.

In the meantime, did you see what you get if you try the same thing from Putty or from a Linux terminal?

Reading around it seems server authentication using certificates in ssh, rather than (or as well as?) the standard hashed fingerprint, is a relatively recent introduction and not all that common.

 

[RMerlin]

Use Curl instead. I configured it to use a CA bundle that I added to the firmware, but the wget build Asus added a few months ago does not point to the same CA list.

You can also manually point wget to the CA bundle:

wget https://www.google.com --ca-certificate=/rom/ca-bundle.crt

 

[ASAT]

This works too. Set the default CA bundle for wget:

/jffs/scripts/services-start

#!/bin/sh
echo "ca-certificate=/rom/ca-bundle.crt" > ~/.wgetrc

 

[programatix]

Thanks for the fast reply. wget now works but how about easy_install from the distribute package?

 

[programatix]

Hi,

I now encountering more problem related to root certificate. Python scripts that accessed HTTPS site also have this very same issue. Is there a way to make Python to point to the CA bundle?

 

[RMerlin]

Hi,

I now encountering more problem related to root certificate. Python scripts that accessed HTTPS site also have this very same issue. Is there a way to make Python to point to the CA bundle?

Since Python is not part of the firmware, that will be up to whoever packaged your Python build.

 

[programatix]

Hi,

Ok. I think I resolved the problem. It turns out that I just need to install the ca-certificates package. A simple,

opkg install ca-certificates

resolves the issue.

Thanks for all the help.

 

[martinr]

Great. Thanks for the feedback.