RV042 HTTPS Certificate Errors and Generate New Certificate in VPN/VPN Client Access

[fmarshall]

I had assumed that there was no way to workaround the RV042 generating Certificate Errors when using browser HTTPS management access.

Is that true for sure?

I recently read that a new certificate could be generated on the VPN/VPN Client Access page and sure enough.

If one Generates a New Certificate, it appears that the dates at least are updated so that looks like progress.

The Help says these are only good for the VPN Client situation.  Yet, I read somewhere where they would also work for HTTPS connections.

I'd like to know the step-by-step process for doing so.

The exported files have a .zip extension and the instructions seem to be "just change the extension" as, for example, to .pem.

What I *think* I want to do is install the certificate into Internet Explorer or another browser but there again the file extension seems to be wrong and even if it's changed (which seems odd anyway) it isn't accepted.  I've tried .pfx, .p7b and .sst and none of those worked.  But why should they?

I'm missing something very basic it appears.

[h.dam]

Hi,

I generated the certificate from the VPN Client access page and I got a RV042_xxx_client.pem file.

I then installed it in a web browser, it works.

What is the firmware version of your RV042 ?

Regards

hdam

[fmarshall]

Right now I'm working with a few 1.3.12.19-tm units.

They generate a file with a .zip extension.  I read that changing this to .pem would work but I've not bee able to make it work.

When you say "installed it in a web browser", what did you do?  I've tried....

[h.dam]

Hi,

I use Firefox as web browser. To install the certificat, you can goto:

advanced option -> certificat tab -> show certificats -> import

Regards,

hdam

[fmarshall]

What was the file extension used?

Which tab under View Certificates?

It's still not working for me.....

Thanks.

[h.dam]

Hi,

If you use https, you only need to accept the exception the first time, after you have generated a new certificate on the router.

The file I use is *.pem.

When you click view certificates, you'll see Import button on a pop-up window.

-- hdam

[fmarshall]

The file I *get* is .zip.  But it's not a real .zip as in 7zip doesn't like it.

The only instructions I've read say to simply change the file extension to .pem.

I find that just a bit strange but I'm game.  But it *is* a question.

When you select View Certificates, in Firefox, you get a dialog with 5 tabs:

Your Certificates, People, Servers, Authorities, Others

The first four have an Import button .. so which one works?

So far I've found nothing that works....

[cchamorr]

Hello, 

I have been following this post as I wasn't sure about what you were trying to accomplish. 

It seems you are only looking to get rid of the certificate error message when logging into the router using HTTPS and you are willing to use Firefox.

If that is the case, then you don't need to worry about certificates or anything like that, you just have to add the exception to firefox once and then you will never again be warned about the certificate error.

Here are the steps:

1- You should see something like screenshot 1 when you try to connect to your router. Select I Understand the Risks

2- Click on Add an Exception as on Screenshot 2

3- On the new window, make sure that Permanently Store This Exception is selected and then click on Confirm Security Exception, as on Screenshot 3.

This is it, no need to import or export any type of certificates, and the browser will never again complain about the website.

I hope this was helpful.

[fmarshall]

Presumably one wants to maintain reasonable security.  That's the purpose of the certificates.  So, I one enters an "exception" it's an exception to the URL and the need for a valid certificate.  Doing that leaves the installation subject to man-in-the-middle attacks.  Isn't all that so?

So, yes, I'm trying to get rid of the certificate error message but not by suppressing it.  I want to cause a legitimate interaction.

[cchamorr]

I'm sorry, my suggestion is not what you were looking for. I just got confused with all the information about trying to import the VPN certificate on Firefox because it won't work and even if it would it won't work for your issue.

Let me see if I can clarify this and give you the right answer then.

1- You are trying to make any browser recognize the Web GUI of the router as a secure site.

2- To accomplish this you were trying to import the VPN certificate (.pem file) into your browser (Firefox)

3- You are concerned about security.

Assuming that the information above is correct, this is what you will need to do:

1- To make sure that every browser will recognize the Web GUI of the router as a secure site, you will need to go to a domain registrar (Certificate Authority) like GoDaddy and purchase a certificate for your router.

2- You will then import this certificate into your router so that when any person using any web browser tries to access it, they will pull the information from the certificate you purchased and will recognized the Web GUI of the router as an actual secure site

3- The .pem file is not a valid certificate for this purpose and, in any case, the certificate wouldn't need to be imported on the browser but on the router first.

Once again, I apologize for no understanding your question correctly and I hope this will shed some light on your questions.