Problems getting a valid certificate for router

[Metro]

Hello,

I apologize for what is likely a newbie question.

I'm trying to get a valid certificate setup so that when I visit my router admin interface at https://192.168.1.1, I don't have to accept the errors about invalid certificates each time.

I'm running an RT-AC88U on Merlin's 384.15 firmware. I've successfully set up DDNS with www.DYNDNS.org and I think I have a valid certificate.

However, when I visit https://192.168.1.1 from inside the LAN, I still am shown that I have an invalid certificate.

If I try to visit https://<subdomain>.gotdns.com from inside the LAN:

Am I missing a step? Does everyone get invalid cert messages from inside their own LAN? I don't have any open ports. Am I supposed to open up port 443 to the router web admin?

Thanks so much for your help

 

[RMerlin]

For starter, you can't get a valid LE certificate for an IP address, it has to be a public domain name.

 

[Metro]

For starter, you can't get a valid LE certificate for an IP address, it has to be a public domain name.

Thanks Merlin! Your firmware is fantastic. Thank you for all of your work!

I understand about the IP address and LE. Should https://<subdomain>.gotdns.com load the web admin interface from inside the LAN?

Am I missing some obvious solution to invalid certs when accessing the web admin interface?

 

[Maverickcdn]

I understand about the IP address and LE. Should https://<subdomain>.gotdns.com load the web admin interface from inside the LAN?

Only if WAN access is enabled in the GUI over HTTPS (highly recommend a non-standard username and strong password, but even more strongly recommend not doing this at all)
Once enabled, if you visit your DDNS address you shouldn't get a certificate warning, you should be able to check the SSL lock symbol in your browser and it will say secured with a LE certificate and will load the GUI

Am I missing some obvious solution to invalid certs when accessing the web admin interface?

You can look into creating a self-signed certificate for your LAN IP for when you access your LAN router address, but if I remember correctly you need to manually add your selfsigned certificate authority to every device that will access it on the lan for the warning not to appear.

 

[Metro]

Thank you very much. This makes complete sense and it sounds like I'm not missing anything major. I'll likely just keep navigating around the cert warnings.

Thank you Maverickcdn and Merlin!

Only if WAN access is enabled in the GUI over HTTPS (highly recommend a non-standard username and strong password, but even more strongly recommend not doing this at all)
Once enabled, if you visit your DDNS address you shouldn't get a certificate warning, you should be able to check the SSL lock symbol in your browser and it will say secured with a LE certificate and will load the GUI



You can look into creating a self-signed certificate for your LAN IP for when you access your LAN router address, but if I remember correctly you need to manually add your selfsigned certificate authority to every device that will access it on the lan for the warning not to appear.