Router keeps generating its own certificate despite having Let's Encrypt after 3006.102.5 update

[Ceejus]

Ever since updating my GT-BE98 Pro to 3006.102.5, I keep encountering an issue where my browsers randomly stop trusting my DDNS address due to suddenly reading a self-signed router-generated root certificate rather than the Let's Encrypt certificate that is actively shown in the DDNS section. Selecting "Auto" under the DDNS, resaving, then switching back to Let's Encrypt gets the browser to begin reading the Let's Encrypt certificate for a little while (anywhere between 20 minutes - a few days) before eventually presenting another self-signed root certificate again.

What is causing this? I wasn't seeing this issue with 3006.102.4. Is there a workaround that doesn't involve a factory reset?

 

[Ripshod]

Enable connections by only https. No reason discovered yet but my router seemed to serve up an self-signed tls instead of let's Encrypt when access was set to "Both".
**Edit**. Just tested and it still does the same on the alpha, but no surprise as only gui elements have been changed.

 

[scootertramp]

Seeing the same issue, but I have only noticed it after a reboot. Connections are set to https only.
Have to jump thru the same hoops to get Let's Encrypt working again.

 

[Ceejus]

Enable connections by only https. No reason discovered yet but my router seemed to serve up an self-signed tls instead of let's Encrypt when access was set to "Both".
**Edit**. Just tested and it still does the same on the alpha, but no surprise as only gui elements have been changed.

Have always had it set it to HTTPS only and can confirm it still is. As this only started after the 3006.102.5 update, my guess is that it's an unreported bug.

 

[Ripshod]

Have always had it set it to HTTPS only and can confirm it still is. As this only started after the 3006.102.5 update, my guess is that it's an unreported bug.

OMG! So embarrassing. It was the other way around.

Wrong certificate when HTTPS only

Just a heads-up, not really a major issue but some may get caught out. I use a Let's Encrypt certificate on my router, mainly because the DDNS client makes one available. Everything is fine if I select "BOTH" under Administration>System>Local Access Config>Authentication Method the Let's Encrypt...

www.snbforums.com

Perhaps you could try switching to Both then back to https. A restart of the httpd service is needed but if your ssh-foo is as bad as mine s reboot would do it.

 

[Ceejus]

OMG! So embarrassing. It was the other way around.

Wrong certificate when HTTPS only

Just a heads-up, not really a major issue but some may get caught out. I use a Let's Encrypt certificate on my router, mainly because the DDNS client makes one available. Everything is fine if I select "BOTH" under Administration>System>Local Access Config>Authentication Method the Let's Encrypt...

www.snbforums.com

Perhaps you could try switching to Both then back to https. A restart of the httpd service is needed but if your ssh-foo is as bad as mine s reboot would do it.

So the issue vanishes if you switch from HTTPS to BOTH? Interesting. Is Merlin aware of this issue? Guessing it would be an easy fix for 3006.102.6.

 

[Ripshod]

It's possible Merlin is aware. That thread was posted in the open with a title that should have piqued their interest.
If you want to post this info into the relevant release thread tagging me, I'll pop in and confirm your findings there.

 

[Ceejus]

It's possible Merlin is aware. That thread was posted in the open with a title that should have piqued their interest.
If you want to post this info into the relevant release thread tagging me, I'll pop in and confirm your findings there.

The topic for the 3006.102.5 release was locked on 9/4. At this point we'll just have to wait until the 3006.102.6 thread.

 

[Ripshod]

@RMerlin, any thoughts?

 

[Ripshod]

Strange things, two weeks before hallowe'en. After a reboot, despite being set to "HTTPS" the router starts serving up the self-signed certificate again.

Perhaps you could try switching to Both then back to https

is my only fix.
Time for line 1 of the serenity prayer

 

[RMerlin]

libletsencrypt.so is closed source, so I don't touch anything related to it.