Root Certificate download is empty

[ZTHawk]

Today I updated My AX88U to 3004_388.10_2. When opening the router website via HTTP I got a recommendation to download a root certificate and switch to HTTPS.
Clicking the download link resulted in an empty file (0 KB).

But opening the website (https://router.asus.com:8443) does not show any invalid certificate. I have not uploaded any custom certificate.
BTW: I am have registered a DDNS domain "<my_name>.asuscomm.com" using a "Free Certificate from Let's Encrypt".
WAN "Authentication Method" is set to BOTH.
In the end, my only problem is, that the download link (http://router.asus.com/cert.crt) is not realy working.

 

[jzchen]

WAN or LAN Authentication Method? Not safe, or I do not think it's an option to have Both for WAN access. I just noticed that Merlin has a note to use the DDNS address for LAN access, specifically:

https://<my_name>.asuscomm.com:8443

Which is the exact same for WAN access...

EDIT- It only allows one certificate at a time...

 

[ZTHawk]

Only the WAN Page has the option to set HTTP / HTTPS.
Access from WAN is disabled anyway.

Anyway, your reply does not answer the issue to download the certificate, which is proposed by the router.

 

[Ripshod]

Only the WAN Page has the option to set HTTP / HTTPS.
Access from WAN is disabled anyway.

Anyway, your reply does not answer the issue to download the certificate, which is proposed by the router.

What option do you have set here, under Administration>System?

 

[jzchen]

Only the WAN Page has the option to set HTTP / HTTPS.
Access from WAN is disabled anyway.

Anyway, your reply does not answer the issue to download the certificate, which is proposed by the router.

I haven't come across this specific use case because the whole reason for setting up DDNS and Let's Encrypt is to allow access from WAN for ISP service that gives a Dynamic IP address.

As I know you are limited to one or the other: Let's Encrypt or Router generated root certificate. So maybe because you've generated a DDNS and Let's Encrypt certificate the option to download Root Certificate is erased from your settings pages...

IF you switch from Let's Encrypt to Auto and refresh the page I am hoping the Root Certificate download is available, or maybe one of these:

http://asusrouter.com/cert.crt

http://192.168.50.1/cert.crt

 

[jzchen]

@Ripshod your DDNS address is not covered enough I can still make it out...

 

[ZTHawk]

I mixed something up

• Administration -> System: Here is the HTTP/HTTPS/BOTH option
  • Set to BOTH and 80 / 8443
• WAN -> DDNS: Here are the certificate options
  • Set to Lets Encrypt

After changing it to "Auto" (like you suggested) I was now agble to download the certificate (which in fact is a Root Certificate generated by the router).

Now everything is working fine. Thanks @jzchen

PS: Here is the list of IPs/Domains registered with the routers own certificate:

• <my_ip_v4>
• router.asus.com
• 192.168.50.1 (??maybe guest network??)
• <my_ip_v4_from other network (higher level)>
• 0.0.0.0
• <my_ip_v6>
• www.asusrouter.com
• <my_name>.asuscomm.com
• repeater.asus.com
• www.asusrepeater.com
• ap.asus.com
• www.asusap.com
• asusrouter.com
• asusrepeater.com
• asusap.com
• www.asusswitch.com
• asusswitch.com
• www.asusnetwork.net
• asusswitch.net
• asusrepeater.net
• asusap.net
• zenwifi.net
• expertwifi.net

 

[jzchen]

Just to answer your curiosity the 192.168.50.1 is the default private LAN IP address assigned to practically all later model ASUS routers. How'd you get that list btw???

 

[ZTHawk]

After connecting via HTTPS, I have inspected the certificate that the router identified with (via a browser) (in other words the SSL certificate).