HOWTO: use a Let's Encrypt ssl certificate on HTTPS web interface

[Chrysalis]

sounds like a good idea to me.

 

[kreutpet]

i am actually trying to use xca to install certificates based on this wiki
https://gist.github.com/davidbalbert/6815258

unfortunately the certificate i was not successful as the loaded certificate get replaced after restart of http
http://www.snbforums.com/threads/how-do-i-install-free-ssl-certificates-on-asuswrt-merlin.29479/

in case you are successful it would be great if you could share how you created the certificate in xca

thx

 

[XIII]

I'm currently using self-signed certificates for router.asus.com, since I don't want to expose the web GUI to the world.

However, RMerlin 380.65 apparently can change that host name. Can I set it to <name>.asuscomm.com and now use Let's Encrypt without exposing the web GUI outside my LAN?

 

[netmik3]

Stunnel on Windows may work too

 

[florid]

I do not see the reason the issue global trusted ssl certificate for home router web gui if not need to manage it thru WAN interface.
I also do not see the reason to open home router web management access to whole Internet. If you have use case to manage it remotely, you can easily create a VPN tunnel to the router or internal hosts.

 

[RMerlin]

However, RMerlin 380.65 apparently can change that host name.

You've always had the ability to change it, there's nothing new there. I merely ensured that any configured hostname had priority over the built-in one (router.asus.com) when resolving the router's IP using your router's dnsmasq.

 

[XIII]

You've always had the ability to change it, there's nothing new there. I merely ensured that any configured hostname had priority over the built-in one (router.asus.com) when resolving the router's IP using your router's dnsmasq.

Ah, then I misunderstood the release notes. Thank you for clearing this up.

 

[justmwa]

FWIW https://acme.sh works fine too, only requiring bash. Much lighter than the original LE client ! And it supports DNS based auth as well
https is all about trust and thinking that DV are any less safe than OV or EV is wishful thinking ! Do you know all CAs in your browser and what countries are behind them ?
And having green everywhere (even for private stuff) allows one to stop the bad habit of bypassing self-signed and invalid certs like a robot (which is becoming more and more painful as browsers upgrade).