My goal is to reach LUCI interface of my 3 Openwrt devices by a secure HTTPS connection instead of the standard HTTP. I access LUCI always from the same two clients so adding a certificate in the Brave browser is no problem (access need from a Windows and Android device).
I have tried multiple methods all without a proper result. My question now is what is the easiest way to setup a HTTPS connection to your LUCI interface? I prefer to have a one set and forget onetime setup without a yearly expiry of self-signed certificates. I donât own an domain name to use with Letâs encrypt. I do use a DDNS link from my main router to a duckdns.org name.
Options already tried (without success) the warning remains âYour connection is not privateâ;
A new option I came across is use a duckdns free domain name, and create letâs encrypt and run a Nginx Proxy manger on an extra linux server. As per this video. Disadvantage is an extra server in your network is required and a DNS server to have access youâre your internet is down: https://www.youtube.com/watch?v=qlcVx-k-02E
onetime setup without a yearly expiry of self-signed certificates
Not possible at all⌠See cab forum baseline 2.1.7 â 6.3.2 Certificate operational periods and key pair usage periods
Typically you âdont have to do anythingâ for https: to work out of the box.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Hereâs guide to have ârealâ letsencrypt ssl certificates on your luci using acme-dns.
Please note that you MUST own some domain name and be able to create CNAME DNS records for itâs subdomains.
Thanks for your reply. As I donât own a full domain name is this something that will work with a free domain service as duckdns.org? And how will this work for multiple access points? (as I currently have only one duckdns.org DDNS service running for only my main router (e.g. myname.duckdns.org) and not for all my access points?)
What about a pragmatic approach, in the sense of just accepting the bad cert once (per device)?
DDNS and letsencrypt is an option, but gets really ugly once you have multiple devices to take care of (unless you go IPv6-only, which is an option) and requires at least some internet-side accessibility to your uhttpd instance (not recommended at all).
A self-signed CA and your own certs is possible, but at least I wouldn't want to take care of the CA deployment around all of my (client-) devices (too many, too many different approaches, possible, but really inconvenient). On top of that the private CA isn't exactly improving security, unless you treat it veeery carefully.
Yes, I realize that this situation sucks for LAN-only devices, both in the sense of certs/ cert deployment and browsers increasingly disliking unencrypted http and self-signed certs, but at least for me the approach of accepting the self-signed cert once (per client/ per renewal time frame) is the least problematic approach.
EDIT: I got it working again. The main problem was I misinterpreted DNS.1 in my self-signed certificates. I used the actual DNS IP instead on my DNS hostname. This DNS hostname I verified with nslookup to the IP were needed the certificate for. E.g. nslookup 192.168.178.48. Then I insured the IP and the correct DNS.1 host name is used in my self-signed certificate. The DNS hostname I also use and CN name option. Now I can make new self certificates with openssl and with a tool as XCA.
And to answer my other question. You donât need any luci-app-uhttpd you can just overwrite the files
/etc/uhttpd.crt
/etc/uhttpd.key
service uhttpd reload
And active the HTTPS redirect by:
uci set uhttpd.main.redirect_https='1'
uci commit uhttpd
service uhttpd reload
Safari doesn't support half of the content on the internet, let alone basic regex, and a host of other features. I'm shocked that anyone still uses it.
Regarding the other option, I progressed from trying to do everything on my router to using an old netbook as a debian server (to now two mini PCs and proxmox). I run Nginx Proxy Manager in Docker. I donât need a separate DNS server for offline access, I use OpenWRTâs wildcard DNS features. I do have a separate DNS server (on the server) solely to resolve to Tailscale addresses, so that my subdomains work seamlessly from anywhere.
As for domains, I would just buy the 1 year discount scam price (~1$) and throw it away after the year. This is a cheap option unless you have dozens and dozens of subdomains youâll need to migrate every year. Nginx PM can use DNS challenge to get wildcard certs and auto-renew.
