Feature Request:GUI for lets encrypt cert requests and renewal.

[Chrysalis]

you been serious? its a lan device, not an internet device.

If the certificate changes (e.g. MITM) the user is still alerted anyway.

So you add existing cert of router to trust store.
No prompts.
If a MITM occurs or other change of cert, new prompt appears.

 

[Nullity]

you been serious? its a lan device, not an internet device.

If the certificate changes (e.g. MITM) the user is still alerted anyway.

So you add existing cert of router to trust store.
No prompts.
If a MITM occurs or other change of cert, new prompt appears.

Adding a CA (Let's Encrypt) means all certs signed by the CA are valid. Constant, manual overrides are unneeded.

If usage is purely internal then Let's Encrypt is a bit strange, but it seems like many users are running a publicly acessible VPN which does benefit from HTTPS and usage of a CA.

 

[Chrysalis]

Given letsencrypt certs only last 3 months the renewals will be more work then whitelisting the cert, I whitelisted my router cert several months ago.

So an administrator is going to go to all the trouble of getting a trusted certificate authority just so they dont have to whitelist the cert on their local router?

VPN's may be a different thing, but remember these routers are for personal not commercial use.

 

[fink.nottle]

Given letsencrypt certs only last 3 months the renewals will be more work then whitelisting the cert, I whitelisted my router cert several months ago.

So an administrator is going to go to all the trouble of getting a trusted certificate authority just so they dont have to whitelist the cert on their local router?

VPN's may be a different thing, but remember these routers are for personal not commercial use.

Well, letsencrypt's idea is to auto-renew. So ideally, you shouldn't have to do anything once everything is setup. The auto-renewal stuff is still iffy, even on proper linux. So it would take some time and effort for it to mature on wrt, but if/when it does, it should work seamlessly.

 

[Chrysalis]

for people who really want to do this then use a linux machine to host the domain for the cert generation.

Script on the router to call the cert script over ssh, and when complete scp the file back to router.

 

[Nullity]

for people who really want to do this then use a linux machine to host the domain for the cert generation.

Script on the router to call the cert script over ssh, and when complete scp the file back to router.

Why not use the (Linux-based) AsusWRT router?