Asus AC5300 SSL / HTTPS Install & Configuration Help Please

[Sharptail]

Hello Small Net Builders! Sorry, first post and it's a long one.

While I am no stranger to networking and router configuration I have never had to deal with https before and the installation of SSL certificates has me baffled. I am hoping to find some help here.

The goal is to allow secure client access via the Internet to a USB hard drive plugged into the router. Access could be either a browser or an FTP client.

My setup is as follows. The router is an Asus RT-AC5300 currently running Merlin's firmware (version 380.67). This is plugged into a Netgear ProSAFE GS108T smart switch, with various other devices attached including my workstation running a Linux distro. No other routers in the system.

Connected to the AC5300 is an USB hard drive (1TB). It is my ambition to have a small handful of clients access this drive from the Internet for the purpose of downloading or viewing various information files, and uploading files for my perusal. There will be no more than 8 clients authorized for access and individual file sizes will not exceed 10 MB. The processing power of the AC5300 seems more than sufficient for this purpose and all is set up and working via AiCloud - Cloud Disk. Smart Access and Smart Sync are turned off.

Access to the drive site from the Internet is through an asuscomm domain configured through the DDNS client in the router. Works great. In the USB Application tab AiDisk is active and under Media Service and Servers Network Place (Samba) Share / Cloud Disk is turned on, as is FTP Share. Client access privileges are defined here. No Guest access is allowed. UPnP is turned off. As stated, all this is working well.

HOWEVER, anyone accessing the site is warned that it is insecure, will infect your computer, steal your identity and probably kill babies. This does not instill confidence in my clients.

Since client login is via user name and password, and since this interface is exposed to the Internet, an encrypted https connection on port 443 of the router is desired to protect the user name and password. This is where my problems begin.

Following various instructions on the web I set up an Apache server on my workstation, redirected port 443 from the router to it, and installed a LetsEncrypt certificate chain. Port 443 was then un-redirected. Https login was activated via the router'sGUI. I cut and pasted the key and cert files (via SSH) from the server into the .pem files on the router. All seemed to go well until I restarted the router and all hell broke loose.

First, the installation didn't work. No https connection. Then this installation absolutely toasted my wi-fi setup, first slowing it down and then preventing Internet access from all the wireless connections. Then it would log them out and prevent re-connection. No amount of fiddling, undoing or resetting would restore the wireless connections. A full reset and re-installation of the firmware was required to regain wi-fi operations. (Note: this was using ASUSWRT firmware).

After three slightly varying attempts at this, all with the same result, I decided to give the Merlin firmware a chance. 30/30/30 reset and a trouble free flash. I have used Merlin's firmware in the past on an N66U and liked it, so thought it worth a try.

So now I have the router completely reconfigured including an OpenVPN server and client using a router generated certificate. Everything I want is working and tested EXCEPT for the https connection to access the files. All current settings are saved, and the info on the USB hard drive is backed up.

Other possibly pertinent info: Port 80 coming in from the 'net is forwarded by the router to a small informational website running on another machine on the LAN. Again, this works well.

BUT I am now a little gun shy. It is clear that I don't have the foggiest clue what I am doing when it comes to installing the SSL certificates. So before I toast my router yet again, I thought it prudent to come here and ask for advice.

Has anyone here successfully installed SSL certificates (on the AC5300 or similar) to work with AiCloud / Cloud Disk access via DDNS? If so what procedures were used? Has anyone else seen the installation process interfere with the wireless functionality? I'm so close to finishing this project, but so far away ...

Thank you in advance for any information or opinions you may have to offer.

Sharptail

 

[Sharptail]

So the good news is that with the Merlin firmware installing the cert .pem and key.pem files does not break the router.
Bad news is that there is still no secure connection. I am beginning to believe that the problem is the .pem files themselves

 

[Pseudomax]

(forgive me ... I have very little knowledge of these matters hence I am well aware of the possibility of breaking something!)

Hi, I know this is a bit of an old thread ... but I am trying to do almost exactly the same thing! I am wanting to use ftp with tls and connect via ubuntu curlftpfs. I have (I think) successfully logged into the router, but only if I don't verify the peer, so I am trying to add the correct certificate to ca-certificates.crt file.

From the router I seem to have a choice of 3 files in the jffs folder that could be correct: "cert.pem", "ftp.crt", "key.pem"

Please can someone tell me which is the public key for the client logging into the server? ... or as is highly possible, what I have missed in doing this? I have already tried adding each of the certificates to the end of the "ca-certificates.crt" file and then reloading them (I think) using:

update-ca-certificates --fresh

However, I still get an error messge from the client using curlftpfs telling me that the certificate verification failed. So either the wrong certificate or it is not recognised correctly.

Help gratefully received!!

 

[Pseudomax]

Any thoughts?

 

[Pseudomax]

My last attempt at a bunp! Really just want to know what each certificate in jffs folder is for ...

 

[Zonkd]

@Pseudomax I should ask what’s the reason you’re trying to do this? By that I mean are you just a standard home user trying to remotely access your own LAN and router services? Or is this needed for other people to use, like in a professional work environment? The last guy wanted it for his clients.

General advice: You should first disable all the typical Asus remote access features, don’t expose router webui login page or FTP or anything else to WAN. Do not use DMZ. Do not use port forwarding. You want to keep ports closed. Disable UPnP is preferable too.

Running OpenVPN server on the router is the safest method for remote access to router and you won’t need to fuss with all this certificate stuff. Read on.

OpenVPN gives you an encrypted connection inside your trusted LAN. Once connected you can directly login to the router with web browser and SMB or FTP. The PC will behave exactly as if you were at home on the LAN. If the LAN is trusted you shouldn’t need to stress about ssl certificates, you can just enable https on the router webui and use the default self-signed certificate the router generates. (There is an option to make the router certificate persistent instead of creating a new one each tile it reboots. Your or the client would accept it once and never see it again. Otherwise you could just get a letsencrypt certificate with a few clicks.)

Once the OpenVPN server is running on the router you would install an openvpn client such as TunnelBlick (free) or Viscosity (paid) on your PC and import the client config file that you would download from the router webui. You can also get an OpenVPN app for your phone and do this.

As someone who has been in this situation I realise all the options are confusing at first but it’s well worth taking the time to learn how to do this so all your traffic is encrypted between your remote PC and the router. With some reading I learned how to do it on the router and also manually at the command line on macOS. Search the forums, read online, ask questions.

 

[Pseudomax]

@Zonkd firstly thank you for taking the time to reply ... it is greatly appreciated.

To answer some of your questions ... I do actually use OpenVPN for some remote access, however I have a small business that I am trying to set up and a project management tool that I work on remotely makes daily backups. Within 8 days my server space is full and I have to remember to go and delete some of these backups. The intention I had was to use ftp with tls to connect to an external hardrive I have plugged into the router. I would then have months of backup before having to delete any. The reason for ftp with tls is because this is the only way to mount my remote harddrive on the server as this is the only way the project management software can find that storage. So I am ineffect limited by the project management software. If you believe that there is a different way to do this then I am very keen to hear your thoughts further. Obviously the curlftpfs is the only software that seemed to offer a mounted hard drive and a remote network connection...

 

[Zonkd]

@Zonkd firstly thank you for taking the time to reply ... it is greatly appreciated.

To answer some of your questions ... I do actually use OpenVPN for some remote access, however I have a small business that I am trying to set up and a project management tool that I work on remotely makes daily backups. Within 8 days my server space is full and I have to remember to go and delete some of these backups. The intention I had was to use ftp with tls to connect to an external hardrive I have plugged into the router. I would then have months of backup before having to delete any. The reason for ftp with tls is because this is the only way to mount my remote harddrive on the server as this is the only way the project management software can find that storage. So I am ineffect limited by the project management software. If you believe that there is a different way to do this then I am very keen to hear your thoughts further. Obviously the curlftpfs is the only software that seemed to offer a mounted hard drive and a remote network connection...

I think I understand now. What is the project management software called?

Edit: you could schedule a cron job in the server to erase the oldest backup to clear storage space ready for the automatic next backup? That solves the problem of doing it manually but doesn’t increase the days of backup you keep. If you can only choose one backup destination then safer to continue using the server space because it’s guaranteed to be online (assuming your server host has RAID and power backup systems). Your home Asus may not be online due to power outage and the attached hdd could fail or get corrupted resulting in data loss. Really I just wouldn’t place my trust in ASUS consumer routers for this task with all the bugs and vulnerabilities. Maybe think about a QNAP or Synology NAS designed for business environments. Synology have fantastic GUI and packages and apps. Try the demo. It has necessary security features the ASUS does not provide. It could do what you want and more.

https://www.synology.com/en-us/dsm

 

[Pseudomax]

It is 'jira' and the software particularly causing the problem is 'confluence'