I just installed acme and downloaded certificates from Let's encrypt on my openwrt router, but it fails with ERR_SSL_PROTOCOL_ERROR when I try to connect the luci from chrome outside.
I installed certificates with the following command
DuckDNS_Token="MyToken" /usr/lib/acme/acme.sh --issue -d MyDomain -k ec-256 --dns dns_duckdns
[Mon Feb 13 14:35:36 UTC 2023] Using CA: https://acme.zerossl.com/v2/DV90
[Mon Feb 13 14:35:36 UTC 2023] No EAB credentials found for ZeroSSL, let's get one
[Mon Feb 13 14:35:39 UTC 2023] Registering account: https://acme.zerossl.com/v2/DV90
[Mon Feb 13 14:36:06 UTC 2023] Registered
[Mon Feb 13 14:36:06 UTC 2023] ACCOUNT_THUMBPRINT='HvioALIo96dkelFRGF00DezKkzIYgjHt1bn6Xhewu8w'
[Mon Feb 13 14:36:06 UTC 2023] Creating domain key
[Mon Feb 13 14:36:06 UTC 2023] The domain key is here: /root/.acme.sh/MyDomain_ecc/MyDomain.key
[Mon Feb 13 14:36:06 UTC 2023] Single domain='MyDomain'
[Mon Feb 13 14:36:06 UTC 2023] Getting domain auth token for each domain
[Mon Feb 13 14:36:43 UTC 2023] Getting webroot for domain='MyDomain'
[Mon Feb 13 14:36:43 UTC 2023] Adding txt value: W6C0-0mvaainHKaI99CzIbWnuoHvwJe6YZoVWwkp3uI for domain: _acme-challenge.MyDomain
[Mon Feb 13 14:36:43 UTC 2023] Trying to add TXT record
[Mon Feb 13 14:36:44 UTC 2023] TXT record has been successfully added to your DuckDNS domain.
[Mon Feb 13 14:36:44 UTC 2023] Note that all subdomains under this domain uses the same TXT record.
[Mon Feb 13 14:36:44 UTC 2023] The txt record is added: Success.
[Mon Feb 13 14:36:44 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Mon Feb 13 14:37:06 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Mon Feb 13 14:37:06 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Mon Feb 13 14:37:06 UTC 2023] Checking MyDomain for _acme-challenge.<MyDomain>
And I can see the certificate
/root/.acme.sh/MyDomain_ecc/MyDomain.cer
/root/.acme.sh/MyDomain_ecc/MyDomain.key
port 443 can't be opened for now, I set up to forward MyPort to 443
/etc/config/uhttpd
config uhttpd 'main'
list listen_http '0.0.0.0:80'
list listen_http '[::]:80'
list listen_https '0.0.0.0:443'
list listen_https '[::]:443'
list listen_https '0.0.0.0:MyPort'
list listen_https '[::]:MyPort'
option home '/www'
option rfc1918_filter '0'
option max_requests '3'
option max_connections '100'
option cgi_prefix '/cgi-bin'
list lua_prefix '/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'
option script_timeout '60'
option network_timeout '30'
option http_keepalive '20'
option tcp_keepalive '1'
option ubus_prefix '/ubus'
option cert '/root/.acme.sh/MyDomain_ecc/MyDomain.cer'
option key '/root/.acme.sh/MyDomain_ecc/MyDomain.key'
option redirect_https 'on'
/etc/config/firewall
config redirect
option name 'Lucy-From-Wan'
option src 'wan'
option src_dport MyPort
option dest 'lan'
option dest_ip '192.168.1.1'
option dest_port '443'
option target 'DNAT'
option proto 'tcp'
and then
/etc/init.d/uhttpd restart
/etc/init.d/firewall restart
Please help me to solve this issue
Thanks in advance
When running a service on the router, open the port don't forward it.
config rule
option name 'Luci-From-WAN'
option src 'wan'
option proto 'tcp'
option dest_port MyPort
option target 'ACCEPT'
Doing the above is not recommended. Using https and a certificate is to protect the user from connecting to a fake site or having communications intercepted by a man in the middle. It does nothing to protect the server side from hacking attempts, and LuCI is not intended to be hardened enough to be attached directly to the Internet.
Thanks for your reply,
I just changed the firewall as you recommend, however connection fails with the same error.
Do you have any other idea for this?
There is no .pem file in the directory, there are only MyDomain.cer, MyDomain.conf, MyDomain.csr, MyDomain.csr.conf, MyDomain.key in the /root/.acme.sh/MyDomain_ecc/
Whenever reboot or /etc/init.d/uhttpd restart after installed the certificate from Let's Encrypt, it overwrites /root/.acme.sh/MyDomain_ecc/MyDomain.key
So, I backed up and restored MyDomain.key, but it generates the same error
I don't think that the following in /etc/config/uhttpd is proper
Not really, the thing is simple. Get the correct key and certificate on the router, configure them in uhttpd, restart uhttpd. You are somehow not able to get the proper certificate, so better follow the instructions.
Actually, when I install the certificate files from Let's encrypt, there is no fullcert.pem.
And I found that
if there is no file in the directory where it points in /etc/config/uhttpd,
it automatically copies corresponding files from /etc/ like the following
when '/etc/init.d/uhttpd restart' or reboot
copies /etc/uhttpd.key to /root/.acme.sh/MyDomain_ecc/MyDomain.key, if there isn't MyDomain.key
Actually, /etc/uhttpd.crt and /etc/uhttpd.key were generated to the default path long ago by uhttpd.
So when I loaded the webpage, the uhttpd on openwrt transfers the fullcert.pem to the browser, which showed that issuer of cert is openwrt.
As result, the current setting is the same as the beginning,
however 'ERR_SSL_PROTOCOL_ERROR' also disappers probably because I disabled cashe and cookies on chrome while I was trobleshooting.