NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Implement Let's encrypt sertificate generation instead of self signed sertificate generated in all Nighthawk routers: R7000, R78000, R8000 and so on. It would be more secure. Many other router manufactures Asus, Zyxel Keenetic, D-Link now use Let's encrypt for all secure HTTPS, FTPS and so on connections in the routers.
Also make an option to choose HTTPS connection to router web GUI instead of HTTP.
14 Comments
The ReadyCloud was a typo, should be ReadyShare. I know where the money was and is coming from. It does not make Let's Encrypt a trusted CA for slighty higher security requirements - even the big ones make mistakes. A Let's Encrypt certificate does not have the same value and trust because of the registration process sucks. That's it, you have my backing - but please understand there is a major difference.
It's certainly better than the wildcard certificate where the private key is shared with each NEtgear device (and downloadable firmware)
DNS-Name=www.routerlogin.net
DNS-Name=routerlogin.net
DNS-Name=www.orbilogin.com
DNS-Name=orbilogin.net
DNS-Name=routerlogin.com
DNS-Name=orbilogin.com
DNS-Name=www.routerlogin.com
DNS-Name=www.orbilogin.net
Interestingly no wildcard for mynetgear.com.- The router itself accepts no certificates whatsoever. Https to the router is impossible. It doesn't matter if the cert is self signed or signed by a CA. No certificate can be installed on the router. That is the problem. I want to install a cert on my router and I can't.
cmweiss it appears that Netgear does not share our view of the things - just like many other featires like a configurable firewall rules. Now this idea is to get Let's Encrypt with its RA access to the Netgear (router) products - which inherits the ability to put a private key a d a certificate to the system. Part of the functionality we requested in the other idea (for CAs different from Let's Encrypt).
We have seen many times where lack of attention by vendors to basic security concepts and configurations has compromised their customers data.
In todays internet connected world it is mandatory have valid SSL certificates and other fully functional security related fetures like OpenVPN available, managable and fully working out of the box.
I don't think this should be up for votes to see if it could be included but should be clasified as a major production bug in the product ranges that needs fixing.
