Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

DG1980 · ‎2020-11-11

After I log in to my router, connection status on the browser shows "Not secure". I click the exclamation icon and see "Your connection to this site isn't secure". I'm using the latest firmware, V2.7.1.60 (see attachment).

I also noticed the connection is using HTTP instead of HTTPS, which is probably the culprit. I don't recall when, but I'm sure at some point the connection was secure. This may have something to do with an invalid or expired certificate.

Is anyone else having this problem?

FURRYe38 · ‎2020-11-11

The browser is doing that.

What happens if you use HTTPS://192.168.1.1?

It's not a security issue if you use HTTP vs HTTPS on the LAN side for the mangement page.

Though NG has now fully supported HTTPS using this FW version:

https://community.netgear.com/t5/Orbi/RBR50-RBS50-Firmware-Version-2-6-1-40/m-p/1997895/highlight/tr...

DG1980 · ‎2020-11-11

I get a security warning then choose to proceed anyway. It lets me in but the https is crossed out (see screenshot). Also, the firmware version is 2.7.1.60, which is newer than the one you suggested and "Always Use HTTPS to Access Router" is enabled (see screenshot).

FURRYe38 · ‎2020-11-11

Actually v2.7 is a different fork from v2.6 and v2.7 has different features from V2.6. v2.7 is meant for USA region users only.

Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page.

DG1980 · ‎2020-11-11

You're wrong about "This doesn't enable HTTPS on the LAN side". The option "Always use HTTPS" is intended specifically for Local Management (i.e. LAN). Remote management already includes the https prefix. Refer to screenshot again and you'll see it.

Btw, I live in the USA so the firmware applies to me.

CrimpOn · ‎2020-11-11

@FURRYe38 wrote:
Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page.

It seems to me that @DG1980 has a valid point. The screen shot clearly shows "Local Management" with the check box for "Always use HTTPS". Looks like a bug (to me). So, we're back to the problem that Netgear provides no method for users to provide bug reports.

Browsers have different ways of dealing with http/https alternatives. Some browsers appear to search for an https with the same URL before they connect even if the user has specified http.

Can you confirm (a) which browser, and (b) the URL that was entered (http vs https)?

FURRYe38 · ‎2020-11-11

I would install the other FW version v2.6 and see if the problem persists...

@DG1980 wrote:
You're wrong about "This doesn't enable HTTPS on the LAN side". The option "Always use HTTPS" is intended specifically for Local Management (i.e. LAN). Remote management already includes the https prefix. Refer to screenshot again and you'll see it.

Btw, I live in the USA so the firmware applies to me.

FURRYe38 · ‎2020-11-11

I see nothing in the v2.7 version of FW mentioning of HTTPS like v2.6 so NG may have not implemented it yet in v2.7...

@CrimpOn wrote:
@FURRYe38 wrote:
Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page.
It seems to me that @DG1980 has a valid point. The screen shot clearly shows "Local Management" with the check box for "Always use HTTPS". Looks like a bug (to me). So, we're back to the problem that Netgear provides no method for users to provide bug reports.

Browsers have different ways of dealing with http/https alternatives. Some browsers appear to search for an https with the same URL before they connect even if the user has specified http.

Can you confirm (a) which browser, and (b) the URL that was entered (http vs https)?

FURRYe38 · ‎2020-11-11

I would contact NG support about the local management to see if this is the case with v2.7.

@Blanca_O @olympos1625

The remote mangement option is for the WAN side only though when Turn Remote Managment ON is enabled:

schumaku · ‎2020-11-11

@DG1980 Even if there is https support for the LAN - there is no f***n way that https://[LAN-IP] (or even a hostname put in by some tricks) will show anything different but a security warning, and on continuing a red "Not secure" on top in the current modern web browsers. nothing groundbreakingly wrong with it...

DG1980 · ‎2020-11-11

I tried in on the new Edge, Chrome and Firefox with same results. Will try to downgrade to earlier version (if it lets me) and see if anything changes.

I can't submit a bug because the warranty expired. I can't get passed the submit support inquiry page because of that.

FURRYe38 · ‎2020-11-11

Contact one of the forum moderators...

schumaku · ‎2020-11-11

@FURRYe38 wrote:
Contact one of the forum moderators...

Nothing the moderators can change.

@DG1980

If the LAN port does serve https - lack of a valid domain name, a valid signed certificate for that domain name, and typically because most home, SOHO and even many SMBs don't have a fully blown in-house DNS infrastructure, and last but not least because you connect by using an IP address - the browser will show "Not secure" (after accepting some exceptions).

If the WAN (remote access) port does serve https - lack of a valid domain name, a valid signed certificate for that domain name, and typically because most home, SOHO and even many SMBs don't have a fully blown in-house DNS infrastructure, and last but not least because you connect by using an IP address - the browser will show "Not secure" (after accepting some exceptions).

Netgear does not after the ability to generate a CSR, to import a private key and a valid signed certificate - neither for the LAN nor for the WAN - the browser will show "Not secure". And no, even a crappy self-signed certificate would show as "Not secure". The browsers simply don't allow this ...

The least confusion way you can take is to untick that https ("Always use https ....") for the LAN...

FURRYe38 · ‎2020-11-11

He can make contact to let them and NG know though.

schumaku · ‎2020-11-11

@FURRYe38 wrote:
He can make contact to let them and NG know though.

Sure. Trouble is that a community thread is not for teaching basic concepts of https and using certificates.... Netgear made it much worse by adding this https for the device LAN access all over ... just because people "want" it "secure".

FURRYe38 · ‎2020-11-11

I know. However IMO, HTTPS is NOT needed on the LAN side for router managment access. If the PW for the router on the LAN side is kept to one person and one person doing the router mangement, HTTPS is not needed. I've been using HTTPS since my first router 20 years ago and have NEVER ever seen problems about a secure connection on the LAN side to the routers web page. Unless you have nefarious people at home, no real need for HTTPS. But thats my opinion. WAN side, yes, HTTPS should be there and working.

CrimpOn · ‎2020-11-11

@DG1980 wrote:
I tried in on the new Edge, Chrome and Firefox with same results. Will try to downgrade to earlier version (if it lets me) and see if anything changes.

This general topic has been around for several years (http vs. https, certificate issues, etc.).

Could you please humor me and report which browser command was used (http vs https, URL vs. IP address) and what the explanation of the "Insecure" message was (complaint about http never being secure vs. complaint about the SSL certificate being invalid or self-signed.) The explanation usually comes up when I click on some (very small) link on the notice ("details" or some such wording).