×

Introducing the Orbi 970 Series Mesh System with WiFi 7(BE) technology. For more information visit the NETGEAR Press Room.

Orbi WiFi 7 RBE973
Reply

Login to Orbi router displays not secure, using HTTP instead of HTTPS

DG1980
Tutor

Login to Orbi router displays not secure, using HTTP instead of HTTPS

After I log in to my router, connection status on the browser shows "Not secure". I click the exclamation icon and see "Your connection to this site isn't secure". I'm using the latest firmware, V2.7.1.60 (see attachment).

 

I also noticed the connection is using HTTP instead of HTTPS, which is probably the culprit. I don't recall when, but I'm sure at some point the connection was secure. This may have something to do with an invalid or expired certificate.

 

Is anyone else having this problem?

 

 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 1 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

The browser is doing that. 

What happens if you use HTTPS://192.168.1.1? 

 

It's not a security issue if you use HTTP vs HTTPS on the LAN side for the mangement page. 

Though NG has now fully supported HTTPS using this FW version:

https://community.netgear.com/t5/Orbi/RBR50-RBS50-Firmware-Version-2-6-1-40/m-p/1997895/highlight/tr...

 

Message 2 of 17
DG1980
Tutor

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I get a security warning then choose to proceed anyway. It lets me in but the https is crossed out (see screenshot). Also, the firmware version is 2.7.1.60, which is newer than the one you suggested and "Always Use HTTPS to Access Router" is enabled (see screenshot).

Message 3 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

Actually v2.7 is a different fork from v2.6 and v2.7 has different features from V2.6. v2.7 is meant for USA region users only. 

 

Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page. 

Message 4 of 17
DG1980
Tutor

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

You're wrong about "This doesn't enable HTTPS on the LAN side". The option "Always use HTTPS" is intended specifically for Local Management (i.e. LAN). Remote management already includes the https prefix. Refer to screenshot again and you'll see it.

 

Btw, I live in the USA so the firmware applies to me.

Message 5 of 17
CrimpOn
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS


@FURRYe38 wrote:

Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page. 


It seems to me that @DG1980 has a valid point.  The screen shot clearly shows "Local Management" with the check box for "Always use HTTPS".  Looks like a bug (to me).  So, we're back to the problem that Netgear provides no method for users to provide bug reports.

 

Browsers have different ways of dealing with http/https alternatives.  Some browsers appear to search for an https with the same URL before they connect even if the user has specified http.

 

Can you confirm (a) which browser, and (b) the URL that was entered (http vs https)?

Message 6 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I would install the other FW version v2.6 and see if the problem persists...


@DG1980 wrote:

You're wrong about "This doesn't enable HTTPS on the LAN side". The option "Always use HTTPS" is intended specifically for Local Management (i.e. LAN). Remote management already includes the https prefix. Refer to screenshot again and you'll see it.

 

Btw, I live in the USA so the firmware applies to me.


 

Message 7 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I see nothing in the v2.7 version of FW mentioning of HTTPS like v2.6 so NG may have not implemented it yet in v2.7...


@CrimpOn wrote:

@FURRYe38 wrote:

Always Use HTTPS to Access Router is used for remote access from remote locations from the WAN side. This doesn't enable HTTPS on the LAN side of the router on it's web page. 


It seems to me that @DG1980 has a valid point.  The screen shot clearly shows "Local Management" with the check box for "Always use HTTPS".  Looks like a bug (to me).  So, we're back to the problem that Netgear provides no method for users to provide bug reports.

 

Browsers have different ways of dealing with http/https alternatives.  Some browsers appear to search for an https with the same URL before they connect even if the user has specified http.

 

Can you confirm (a) which browser, and (b) the URL that was entered (http vs https)?


 

Message 8 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I would contact NG support about the local management to see if this is the case with v2.7. 

@Blanca_O @olympos1625 

The remote mangement option is for the WAN side only though when Turn Remote Managment ON is enabled:

capture.png

Message 9 of 17
schumaku
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

 @DG1980 Even if there is https support for the LAN - there is no f***n way that https://[LAN-IP] (or even a hostname put in by some tricks) will show anything different but a security warning, and on continuing a red "Not secure" on top in the current modern web browsers. nothing groundbreakingly wrong with it...

Message 10 of 17
DG1980
Tutor

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I tried in on the new Edge, Chrome and Firefox with same results. Will try to downgrade to earlier version (if it lets me) and see if anything changes.

 

I can't submit a bug because the warranty expired. I can't get passed the submit support inquiry page because of that.

Message 11 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

Contact one of the forum moderators...

Message 12 of 17
schumaku
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS


@FURRYe38 wrote:

Contact one of the forum moderators...


Nothing the moderators can change.

@DG1980 

 

If the LAN port does serve https - lack of a valid domain name, a valid signed certificate for that domain name, and typically because most home, SOHO and even many SMBs don't have a fully blown in-house DNS infrastructure, and last but not least because you connect by using an IP address - the browser will show "Not secure" (after accepting some exceptions).

 

If the WAN (remote access) port does serve https - lack of a valid domain name, a valid signed certificate for that domain name, and typically because most home, SOHO and even many SMBs don't have a fully blown in-house DNS infrastructure, and last but not least because you connect by using an IP address - the browser will show "Not secure" (after accepting some exceptions).

 

Netgear does not after the ability to generate a CSR, to import a private key and a valid signed certificate - neither for the LAN nor for the WAN - the browser will show "Not secure". And no, even a crappy self-signed certificate would show as "Not secure". The browsers simply don't allow this ...

 

The least confusion way you can take is to untick that https ("Always use https ....") for the LAN...

 

 

Message 13 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

He can make contact to let them and NG know though. 

Message 14 of 17
schumaku
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS


@FURRYe38 wrote:

He can make contact to let them and NG know though. 


Sure. Trouble is that a community thread is not for teaching basic concepts of https and using certificates.... Netgear made it much worse by adding this https for the device LAN access all over ... just because people "want" it "secure".

Message 15 of 17
FURRYe38
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS

I know. However IMO, HTTPS is NOT needed on the LAN side for router managment access. If the PW for the router on the LAN side is kept to one person and one person doing the router mangement, HTTPS is not needed. I've been using HTTPS since my first router 20 years ago and have NEVER ever seen problems about a secure connection on the LAN side to the routers web page. Unless you have nefarious people at home, no real need for HTTPS. But thats my opinion. WAN side, yes, HTTPS should be there and working. 

Message 16 of 17
CrimpOn
Guru

Re: Login to Orbi router displays not secure, using HTTP instead of HTTPS


@DG1980 wrote:

I tried in on the new Edge, Chrome and Firefox with same results. Will try to downgrade to earlier version (if it lets me) and see if anything changes.


This general topic has been around for several years (http vs. https, certificate issues, etc.).

 

Could you please humor me and report which browser command was used (http vs https, URL vs. IP address) and what the explanation of the "Insecure" message was (complaint about http never being secure vs. complaint about the SSL certificate being invalid or self-signed.)  The explanation usually comes up when I click on some (very small) link on the notice ("details" or some such wording).

Message 17 of 17
Top Contributors
Discussion stats
  • 16 replies
  • 4069 views
  • 1 kudo
  • 4 in conversation
Announcements

Orbi WiFi 7