# HTTPS Downloads - Security Issue **URL:** \ **Category:** Talk about Documentation\ **Created:** [November 12, 2021, 6:08pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733 "2021-11-12T18:08:08Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![boktai1000](https://forum.openwrt.org/user_avatar/forum.openwrt.org/boktai1000/32/96839_2.png) [@boktai1000](https://forum.openwrt.org/u/boktai1000)\ **Post date:** [November 12, 2021, 6:08pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/1 "2021-11-12T18:08:08Z")
I recently went to [https://openwrt.org/toh/hwdata/linksys/linksys\_wrt32x\_v1\_venom](https://openwrt.org/toh/hwdata/linksys/linksys_wrt32x_v1_venom) to grab the latest build for 32X and was hit with some "scary" error messages in the Edge browser about the fact that the links were over http:// to download You can see here: Firmware OpenWrt Install URL: [http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys\_wrt32x-squashfs-factory.img](http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img) Firmware OpenWrt Upgrade URL: [http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys\_wrt32x-squashfs-sysupgrade.bin](http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin) Firmware OpenWrt snapshot Install URL: [http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys\_wrt32x-squashfs-factory.img](http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img) Firmware OpenWrt snapshot Upgrade URL: [http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys\_wrt32x-squashfs-sysupgrade.bin](http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin) To replicate the issue, simply use Microsoft Edge (latest version) and attempt to download and you'll be hit with a security prompt that blocks the downloads. ---
**Author:** ![flygarn12](https://forum.openwrt.org/user_avatar/forum.openwrt.org/flygarn12/32/57396_2.png) [@flygarn12](https://forum.openwrt.org/u/flygarn12)\ **Post date:** [November 12, 2021, 6:15pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/2 "2021-11-12T18:15:37Z")
I saw this also a couple of weeks ago when downloading 21.02.1 images. But since I download imagebuilder and verify them with the gpg public key downloaded when 21.02 branch was released I continued with the download. ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [November 12, 2021, 6:16pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/3 "2021-11-12T18:16:18Z")
@tmomas I thought that we currently had https links in the techdata / ToH pages ? ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [November 12, 2021, 8:49pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/4 "2021-11-12T20:49:15Z")
Related: - [Firmware download links: http or https?](https://forum.openwrt.org/t/firmware-download-links-http-or-https/4638) - [Upgrading OpenWrt firmware using CLI](https://forum.openwrt.org/t/upgrading-openwrt-firmware-using-cli/81821) I'm open for suggestions. ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [November 12, 2021, 9:26pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/5 "2021-11-12T21:26:26Z")
I think that the situation has changed a lot from year 2017 (the first thread), as currently both master and 21.02 already default for https with the opkg package downloads by the router itself. Routers have https support by default since August 2020 (due to WPA3 readiness). > > > To allow HTTPS usage on a router it requires both certificates > (ca-bundle) and a… fitting libustream library (libustream-wolfssl) > > By adding both, uclient-fetch and wget can connect to encrypted HTTP. > > This allows opkg to update package lists in a more secure fashion. > > Suggested-by: Petr Štetiar \ > Suggested-by: Baptiste Jonglez \ > Signed-off-by: Paul Spooren \ opkg switch to https was also done in August 2020 by > > > The variable VERSION\_REPO is used by opkg to download package(list)s. > Now that t…he default installation support encrypted HTTP opkg should > make use of it. > > Suggested-by: Petr Štetiar \ > Suggested-by: Baptiste Jonglez \ > Signed-off-by: Paul Spooren \ > Acked-by: Baptiste Jonglez \ Support for 19.07 will soon end, and all further releases should support https. Also desktop browsing in general is nowadays largely https based, so I see no special reason why we should stick to promoting http downloads any more. ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [November 12, 2021, 11:13pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/6 "2021-11-12T23:13:32Z")
OK, I will take care of changing the dataentries from http -\> https during the next days. ---
**Author:** ![anon89577378](https://forum.openwrt.org/letter_avatar/anon89577378/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon89577378](https://forum.openwrt.org/u/anon89577378)\ **Post date:** [November 14, 2021, 11:48pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/7 "2021-11-14T23:48:25Z")
My vote - > [@Upgrading OpenWrt firmware using CLI](https://forum.openwrt.org/t/upgrading-openwrt-firmware-using-cli/81821/3): > > OpenWrt server no longer allows http for images. As the error message says, you need to install libustream-wolfssl and ca-bundle to enable https support to wget. This requires about 1 MB of flash space. wolfssl is the smallest option if you don't already have another ssl library. If something depending on for example openssl is already installed, use libustream-openssl. Technically you don't need ca-bundle, as you can choose not to verify the server certificate with --no-check-certificate, … ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [November 15, 2021, 9:36pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/8 "2021-11-15T21:36:29Z")
FYI - https links will be visible in the ToH within the next 15..30min. Edit: Done. ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [November 25, 2021, 9:37pm UTC](https://forum.openwrt.org/t/https-downloads-security-issue/111733/9 "2021-11-25T21:37:06Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.