Lets Encrypt vs Persistent

[jtp10181]

Is there an actual advantage to use the lets encrypt cert vs a auto generated one? I tried to import the LE cert to my trusted sites but when accessing the web GUI locally (via IP or router.asus.com) it complains the cert was issued for my ddns name instead. I have disabled WAN access to the GUI per recommendations, so using the DDNS url is useless at the moment. I thought when I had the auto cert I could access it from LAN or WAN without complaint once it was trusted, so the auto-cert seems to have an advantage.

Or do I just need to configure something differently?

 

[RMerlin]

Let's Encrypt will be automatically recognized as safe by all browsers (no need to import anything), while if you generate your own cert, you have to import the signing CA cert into the Trusted Root Authorities repository to get rid of the security warnings.

The LE cert will be only assigned to your DDNS address, while a self-signed (or otherwise custom generated cert) can be for any hostnames of your choice, including IP addresses.

 

[jtp10181]

Yeah the auto generated cert included the lan IP, Hostname, router.asus.com and the DDNS. That's the way to go for me for now.

Is there any possibility to get the LE cert to include all that also? I think I saw a tutorial for making your own. Would be cool if I could use that for pixelserv also and include 192.168.1.2 then you don't have to worry about importing any certs.


Sent from my iPhone using Tapatalk

 

[SMS786]

Let's Encrypt will be automatically recognized as safe by all browsers (no need to import anything), while if you generate your own cert, you have to import the signing CA cert into the Trusted Root Authorities repository to get rid of the security warnings.

The LE cert will be only assigned to your DDNS address, while a self-signed (or otherwise custom generated cert) can be for any hostnames of your choice, including IP addresses.

@RMerlin, I apologize in advance since I am sure you were asked this before, but where is the router admin's automatically generated CA cert located? I hope to finally import it into my system/browser..

 

[jtp10181]

If you are the new firmware and you go to the WAN > DDNS tab there is an Export button. I may be wrong but I think that's new since 382.x, I know the certificate settings moved to that tab also for 382 and I forget where it used to be, in Admin > System maybe.

You can also grab them from /jffs/ssl/ there is a cert.pem and key.pem . You only need the cert.pem and if you rename it to a .crt file you can double click to import on windows. For some reason I am thinking on older firmware they were hidden someplace else but maybe that was the pixelserv certs I had to hunt for. Anyways, you can always use 'find / -iname <string>' to find stuff. Comes in handy when I forget where things are.

 

[SMS786]

If you are the new firmware and you go to the WAN > DDNS tab there is an Export button. I may be wrong but I think that's new since 382.x, I know the certificate settings moved to that tab also for 382 and I forget where it used to be, in Admin > System maybe.

You can also grab them from /jffs/ssl/ there is a cert.pem and key.pem . You only need the cert.pem and if you rename it to a .crt file you can double click to import on windows. For some reason I am thinking on older firmware they were hidden someplace else but maybe that was the pixelserv certs I had to hunt for. Anyways, you can always use 'find / -iname <string>' to find stuff. Comes in handy when I forget where things are.

Appreciate it!

 

[RMerlin]

Is there any possibility to get the LE cert to include all that also?

No. LE will only issue certificate for a FQDN that can actually be tested by them.

 

[RMerlin]

@RMerlin, I apologize in advance since I am sure you were asked this before, but where is the router admin's automatically CA cert located? I hope to finally import it into my system/browser..

It does not generate a CA, only a self-signed certificate. If you want to setup your own CA, you have to do it outside of the router, and then import the certificate you will generate that's signed by that CA.

 

[SMS786]

It does not generate a CA, only a self-signed certificate. If you want to setup your own CA, you have to do it outside of the router, and then import the certificate you will generate that's signed by that CA.

Got it, thanks much!

 

[kvic]

@RMerlin, I apologize in advance since I am sure you were asked this before, but where is the router admin's automatically generated CA cert located? I hope to finally import it into my system/browser..

pixelserv-tls users can take advantage of your Pixelserv CA for hassle free WebUI. Here is the guide from 2 years ago:

https://www.snbforums.com/threads/p...ebserver-for-adblock.26114/page-9#post-252339

 

[SMS786]

pixelserv-tls users can take advantage of your Pixelserv CA for hassle free WebUI. Here is the guide from 2 years ago:

https://www.snbforums.com/threads/p...ebserver-for-adblock.26114/page-9#post-252339

Thanks, been running the https WebUI for a few months now ..works like a charm!