Adding own SSL certificate

[original-birdman]

I'd like to upload my own SSL certificate (I have my own root CA for some local systems, and it's installed in my browser) so that I don't need to keep allowing exceptions every time the router-generated certificate changes.

However, there is no indication as to what format this needs to be in in order for the upload to work. (WAN -> DDNS tab, HTTPS/SSL Certificate, Import Your Own Certificate).

Does anyone know? Or where the files lives on the file-system after the upload (so I could just copy it there directly)?

 

[RMerlin]

Standard PEM.

 

[original-birdman]

Standard PEM.

Doesn't work for me.
I select a key and certificate, both in PEM format, Upload them and I'm left with a newly-generated Asus certificate.

 

[original-birdman]

OK. Found this in syslog, which may explain why it isn't working:

Jun 29 23:31:26 httpd: Can't get subject/authority key identifier. ([20:F8:7B:6]/[NULL])
Jun 29 23:31:26 httpd: Delete uploaded certificate
Jun 29 23:31:35 httpd: Can't get subject/authority key identifier. ([20:F8:7B:6]/[NULL])
Jun 29 23:31:35 httpd: Delete uploaded certificate

Not sure what the problem is. Apache is happy with similar certificates (for different hostnames)

 

[original-birdman]

OK. Sorted it.

I needed to tick another box when generating the certificate (and then had to generate it again to add IP address fields as well as DNS names...).

Thanks...

 

[Poul Bak]

What box did you need to tick? I can't make it work either.

 

[original-birdman]

Well, I suspect that depends on what you are using to generate them.

I'm using xca, and under the "Extensions" tab I had to select the "X509 Authority Key Identifier" option.
Given that the Validation tab when looking at a Certificate's details was pointing out that this was missing, I'm not sure how I'd missed it for several years.

 

[Poul Bak]

I'm using .net. Several years ago, when Asus changed their certificate policy, I tried to make it work but failed miserably with the message, you also got. I ended giving up.
But your question and answer got me in the right direction. The key was indeed to implement "X509 Authority Key Identifier". Not easy at all, but now I got it working with my own CA, thanks for your help.