After I log in to my router, connection status on the browser shows "Not secure". I click the exclamation icon and see "Your connection to this site isn't secure". I'm using the latest firmware, V2.7.1.60 (see attachment). I also noticed the connection is using HTTP instead of HTTPS, which is probably the culprit. I don't recall when, but I'm sure at some point the connection was secure. This may have something to do with an invalid or expired certificate. Is anyone else having this problem?

DG1980 wrote:I tried in on the new Edge, Chrome and Firefox with same results. Will try to downgrade to earlier version (if it lets me) and see if anything changes.This general topic has been around for several years (http vs. https, certificate issues, etc.). Could you please humor me and report which browser command was used (http vs https, URL vs. IP address) and what the explanation of the "Insecure" message was (complaint about http never being secure vs. complaint about the SSL certificate being invalid or self-signed.) The explanation usually comes up when I click on some (very small) link on the notice ("details" or some such wording).

The browser is doing that. What happens if you use HTTPS://192.168.1.1? It's not a security issue if you use HTTP vs HTTPS on the LAN side for the mangement page. Though NG has now fully supported HTTPS using this FW version:https://community.netgear.com/t5/Orbi/RBR50-RBS50-Firmware-Version-2-6-1-40/m-p/1997895/highlight/true#M105941

I get a security warning then choose to proceed anyway. It lets me in but the https is crossed out (see screenshot). Also, the firmware version is 2.7.1.60, which is newer than the one you suggested and "Always Use HTTPS to Access Router" is enabled (see screenshot).

Actually v2.7 is a different fork from v2.6 and v2.7 has different features from V2.6. v2.7 is meant for USA region users only. Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page.

You're wrong about "This doesn't enable HTTPS on the LAN side". The option "Always use HTTPS" is intended specifically for Local Management (i.e. LAN). Remote management already includes the https prefix. Refer to screenshot again and you'll see it. Btw, I live in the USA so the firmware applies to me.

Login to Orbi router displays not secure, using HTTP instead of HTTPS

16 Replies

Replies have been turned off for this discussion

FURRYe38
Guru
Nov 11, 2020
The browser is doing that.
What happens if you use HTTPS://192.168.1.1?

It's not a security issue if you use HTTP vs HTTPS on the LAN side for the mangement page.
Though NG has now fully supported HTTPS using this FW version:
https://community.netgear.com/t5/Orbi/RBR50-RBS50-Firmware-Version-2-6-1-40/m-p/1997895/highlight/true#M105941
- DG1980
  Tutor
  Nov 11, 2020
  I get a security warning then choose to proceed anyway. It lets me in but the https is crossed out (see screenshot). Also, the firmware version is 2.7.1.60, which is newer than the one you suggested and "Always Use HTTPS to Access Router" is enabled (see screenshot).
  - FURRYe38
    Guru
    Nov 11, 2020
    Actually v2.7 is a different fork from v2.6 and v2.7 has different features from V2.6. v2.7 is meant for USA region users only.
    
    Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page.
FURRYe38
Guru
Nov 11, 2020
I would contact NG support about the local management to see if this is the case with v2.7.
Blanca_O olympos1625
The remote mangement option is for the WAN side only though when Turn Remote Managment ON is enabled:
- schumaku
  Guru
  Nov 11, 2020
  DG1980 Even if there is https support for the LAN - there is no f***n way that https://[LAN-IP] (or even a hostname put in by some tricks) will show anything different but a security warning, and on continuing a red "Not secure" on top in the current modern web browsers. nothing groundbreakingly wrong with it...

Forum Discussion

Login to Orbi router displays not secure, using HTTP instead of HTTPS