Router keeps generating its own certificate despite having Let's Encrypt after 3006.102.5 update

[Ceejus]

I can't actually list any specific problems other than what I experienced myself. I know of other threads where scribe was responsible for other issues, and the general advice around these forums is to just not use it.
You can see my signature, all those addons will run seperately or all together without issue, in my use case.

So far since applying the updates, the issue has not resurfaced, but it still could. I'm thinking one of the add-ons simply needed to be updated to account for 3006.102.5.

 

[Ripshod]

So far since applying the updates, the issue has not resurfaced, but it still could. I'm thinking one of the add-ons simply needed to be updated to account for 3006.102.5.

That's the weird thing for me. A full reset and rebuild (so all the latest scripts) and the fault was still present. Very hit and miss. It seems Asus need to do a lot of work on their code and sort this out. I'm not seeing any reports of this issue on the official asus firmware - yet.
But then, it's not like we reboot that often.

 

[Ceejus]

That's the weird thing for me. A full reset and rebuild (so all the latest scripts) and the fault was still present. Very hit and miss. It seems Asus need to do a lot of work on their code and sort this out. I'm not seeing any reports of this issue on the official asus firmware - yet.
But then, it's not like we reboot that often.

Yup, you might be right. The issue resurfaced. This is weird. Do Merlin's updates incorporate the latest offical Asuswrt firmware updates? It's odd how this issue only started for me after 3006.102.5 when he is saying he doesn't touch any code pertaining to certificates. Let me know if the issue resurfaces for you after applying the Traffic Analyzer workaround. What prompted you to try that specifically anyway?

 

[Ripshod]

Do Merlin's updates incorporate the latest offical Asuswrt firmware updates?

In theory the GPLs should contain the latest at the time of release, but I do recall RMerlin mentioning the GPL releases are specifically generated for his use. Nothing guaranteed, especially in those blobs he can't edit or otherwise access.

Let me know if the issue resurfaces for you after applying the Traffic Analyzer workaround. What prompted you to try that specifically anyway?

I was actually trying to identify a lot of traffic occurring when I was in bed. Turns out a Chinese phone I have was regularly phoning home. Needless to say it isn't anymore. So just coincidence.

 

[bennor]

Do Merlin's updates incorporate the latest offical Asuswrt firmware updates?

RMerlin has explained things in the past...

I get code directly from Asus, it's unrelated to what's released on their website. I have particular requirements that their developers need to meet when preparing the archives, like having the same code base for all models, which is rarely the case with their own firmware releases.

It depends. If you ask them for a GPL drop for a particular model, it will be for the same version that was used for that model's released firmware - which is what the GPL licensing requires them to do. The difference in my case is they build the tarballs for all models within a branch but all on the same version, so I don't need to maintain 20 parallel branches to handle 20 devices on 20 different codebase versions. Sometimes, that version will match a released firmware. Sometimes it will be a newer snapshot, depending on the point in time where they prepare those archives. But in terms of content, yes, that is the same code that is available in regular GPL drops. Just it might be from a more recent git point.

 

[Poul Bak]

Just chiming in because I have only seen this once.
Then I went to 'Administration', 'Firmware updates' and unchecked both.
I think Asus sees it as a security update to install their certificate, if you check that.
Just another thing to try.

 

[Ripshod]

Just chiming in because I have only seen this once.
Then I went to 'Administration', 'Firmware updates' and unchecked both.
I think Asus sees it as a security update to install their certificate, if you check that.
Just another thing to try.

On an RT-BE88U? I have Security Upgrade enabled only, and always have. Right now Let's Encrypt is stable with the Traffic Analyzer work-around.
Testing your way.

 

[bg604]

I have the BE98 Pro.

Switching Traffic Analyzer to On, then rebooting, then turning it Off, and rebooting works.

Not sure why, but the invalid certificate goes away.

 

[Ceejus]

Since updating to 3006.102.6, the issue has yet to resurface for me.

 

[Ripshod]

After update, reset and rebuild the Let's Encrypt certificate is served up just fine now - no need for any work-around.