NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

vpollinzi's avatar
vpollinzi
Aspirant
Jan 20, 2024

Enabling Always Use HTTPS to Access Extender breaks connectivity

Hello - Tried to enable "Always Use HTTPS to Access Extender" for Web Services Management however once enabled, I can no longer connect to extender. Running Windows 10 Pro, build 19045.3930 with latest version of Chrome, Version 120.0.6099.225 (Official Build) (64-bit).

 

The error messages is as follows:
This site can’t be reached. The webpage at https://mywifiext/ might be temporarily down or it may have moved permanently to a new web address.
ERR_SSL_KEY_USAGE_INCOMPATIBLE

 

Appears to be a possible certificate issue. Is yet another subscription service necessary for this feature to work?
Any assistance would be appreciated.

 

4 Replies

  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jan 21, 2024

    Yes, it's a nifty issue with the certificate usage bits, for example on the self-signed certificates in use. Explained in depth here.

    • vpollinzi's avatar
      vpollinzi
      Aspirant
      Jan 21, 2024

      Thanks for your feedback! I suppose the developer/programmer that added the option didn't understand the ramifications of maintaining certificates. Disabling RSA key usage in chrome doesn't buy me any more security than what I have with http protocol, (chrome --force-fieldtrials=RSAKeyUsageForLocalAnchors/DisabledLaunch).
       

      An encrypted connection to management console would have been nice though. Guess I'll have to rely on strong password. Thanks again.

       

      • schumaku's avatar
        schumaku
        Guru - Experienced User
        Jan 21, 2024
        vpollinzi wrote:

        I suppose the developer/programmer that added the option didn't understand the ramifications of maintaining certificates. Disabling RSA key usage in chrome doesn't buy me any more security than what I have with http protocol, (chrome --force-fieldtrials=RSAKeyUsageForLocalAnchors/DisabledLaunch).

        That's not the case. For once one of the browser makers again run ahead for something the industry - and even more consumer devices and infrastructures - can't cope with (like fully featured DNS infrastructures, to allow complete https deployment. This does not abandon any https security. Many more vendors are affected by this wonderful rush forward. The browser will just not look for the keyUsage bits like digitalSignature -and- keyEncipherment which does typically not exist on any self-signed and many CA signed certificates. It won't abandon the basic encryption. The browser simply error-out and won't continue in case the keyEncipherment bit is not set.