NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Status:
Engineering Investigation
Enhancement Request: User-supplied SSL certificates for remote management
There is currently no way to install a proper PKI-chained SSL certificate from a third party like Comodo or StartCom SSL. With all current versions of the NETGEAR firmware, when enabling HTTPS access for remote management, my/all browsers get angry because the R7000 is using a self-signed certificate:
I have a free StartCom SSL cert all generated and ready to install. The problem is, there is no supported way to install this certificate, intermediate cert, and private key, with the R7000.
- Dave
47 Comments
Exactly, that's why we remove Let's Encrypt CA from the systems again. The proceses are not sufficient, and don't compare in any aspect to any other real CA. If you don't understand this part - keep having fun with it, it's ok for home users. It's not good enough for security and trust.
This router is for home users (SOHO router) and that's why we need such feature in it (implement Let's encrypt CA). Let's encrypt sert will be much more usable and secure then self signed untrusted sert generated by R7000.
Do you understand what makes a certificate "trusted"?
What makes a browser show an all green or a limited green "trust"?
Let's Encrypt does open to many doors for abuse. The registration and the related processes are not good enough for a trust. "But my browser showed a green blah....".
Do you understand what is required to have major OS and browsers trusting a CA? Up front: A lot of money.
The feature request up here is NOT about Let's Encrypt. It's about generic CA support.
I'm fine if you want Let's Encrypt. Use search or file a dedicated feature request if there isn't one for it.- I don't care how https is enabled. I don't care if it's with a CA cert or with a self signed cert. I want https period.
- Valid Certificates are the foundation of security.
Are these boards even moderated by NetGear? This was originally posted on 2016-12-15 and nothing????
Well, we're in the Home environment here, so these must be considered consumer devices. Let's Encrypt is a nice solution for this market, as most consumers don't have own domains anyway. The same - lack of a bind ot a customer owned certificate - on the other hand is one of the trust-stopper for that CA. Doing false (say hype) marketing for ACxxxx, AD7200, AX6000 or AX11000 - all numbers most peoplne never see - have priority to keep the market aehm Dollars rolling. With the ability to generate CSRs, to import certificates, there isn't much business to generate. Figure. With thid kind of delay politics, the EoL for many of these devices will come long before they change from their late 1990s router specs. Sad but true.
