[Solved] Invalid cert warning 21.02.0 release

[anon89577378]

Upgraded an Archer C7 v2 from 19.07.08 to 21.02.0.

I'm now getting an invalid cert warning for a self-signed cert when attempting to log in with LUCI.

Never saw this in previous versions.

Both ca-bundle and ca-certificates are installed.

Any ideas?

[slh]

You are trying to reach the webinterface of your router from your client (-computer, which means ca-bundle or ca-certificates installed on the router don't apply - those are only needed for the router to authenticate remote https resources). Your router's SSL certificate presented to your clients are generated at firstboot and self-signed, meaning no CA has signed them for you (how could they, without according configuration, a public domain, etc.) - in other words, you need to accept it (once) on your client(s).

[anon89577378]

Thanks for the clarification on ca-bundle and ca-certificates.

I've accepted it multiple times...it doesn't stick after a browser re-start.

As mentioned, I never saw this issue in previous versions.

[ergamus]

Previous versions never defaulted to using HTTPS, it was a manual choice.

Is the cert exception being saved in your browser? Your browser might be setting a temporary exception instead of adding a permanent one. Look up instructions on how to add/verify self-signed certificates in your browser.

Firefox for example will remove any saved certificate exemptions if you clear your history and have site preferences checked. Same if you auto-clear your history on closing the browser, or use Private mode.

Per the release notes:

In addition, LuCI is now available over HTTPS in addition to HTTP. There is no automatic redirection to HTTPS on a fresh OpenWrt 21.02 installation; however, redirection will be enabled after upgrading from OpenWrt 19.07 to OpenWrt 21.02.

It is always possible to activate or deactivate the redirection to HTTPS like this:

uci set uhttpd.main.redirect_https=1 # 1 to enable redirect, 0 to disable redirect
uci commit uhttpd
service uhttpd reload

[4k3or3et]

May I ask how do you accept the certificate?

[anon89577378]

Found the explanation and solution from @hynman -

OpenWrt 21.02.0 - First Stable Release

In 19.07 the HTTPS enabling libraries were not installed by default, so you did not connect with HTTPS unless you installed the needed SSL libraries (and the required libustream wrapper). Thus you did not receive the certificate warning, although the redirection option was set as enabled. For 21.02 the SSL + libustream libraries are installed by default so there is HTTPS capability. And if you sysupgrade with settings from 19.07, your old dormant setting from 19.07 with the "redirect to https"…

OpenWrt 21.02.0 - First Stable Release

It does actually default to "off" in 21.02 ("no redirection"), but your own old settings (copied from the previous 19.07 version) defaulted to "redirect to https if SSL capability exists" in /etc/config/uhttpd.