Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

littleblackbox is publishing "private keys" that are accessible on publicly available firmwares. Debian calls these "snake-oil" certs. Most of these routers are securing their HTTPS certs with these, and as I think about it, I've never seen one of these internal admin websites with certs that wasn't self signed.

Given a webserver on IP 192.168.1.1, how do you secure it to the point that Firefox doesn't offer warnings (and is still secured)?

share|improve this question

migrated from serverfault.com Jan 6 '11 at 23:43

This question came from our site for professional system and network administrators.

add comment

2 Answers

up vote 2 down vote accepted

The answer depends entirely on the product you're using. If it allows you to install your own SSL certificate, then install one from a CA that's trusted by your browser (possibly your own CA).

If you can't replace the self-signed certificate on the router, you're mostly SOL.

I'm not sure there's much real risk here. The attack profile is pretty small...someone sniffing the network at the right time can get your router's administrative password, but the chances of this happening seem pretty small unless you're frequently authenticating to your router.

share|improve this answer
    
Lets assume I can install a new SSL cert. What should I use for the domain? Surely CAs won't sign an IP address. –  jldugger Jan 6 '11 at 15:57
    
@jldugger: I think most will sign a certificate with an IP address as the Common Name. –  DerfK Jan 6 '11 at 16:14
3  
Also since this is presumably your own environment you can establish a hostname for the router and use that...and, again, you can just create your own CA and configure your browser to trust it, and then you can call things whatever the heck you want. For example, debian-administration.org/articles/618. –  larsks Jan 6 '11 at 16:28
add comment

I assume that firefox is complaining because the cert is self-signed, which is how things usually go.

The way to do this is to either add an exception in FireFox or get an actual valid cert. Last I checked, they ran about $700. And by the way, procuring a valid cert for "192.168.1.1" is impossible on account of it being a local IP.

Simply adding a firefox exception should be fine, though...things will still be encrypted, you just won't be safe from man-in-the-middle attacks.

share|improve this answer
    
You pay 700 dollars for certs? I'm in the wrong business! –  jldugger Jan 7 '11 at 4:26
    
Also, it's not just about shutting up firefox, it's also about fixing the underlying problems better. Thats why I asked this question on serverfault, since a lot of the same problems exist in IT. My fault for adding the word "home" I suppose. –  jldugger Jan 7 '11 at 4:28
    
No, I'm not paying for certs at that price any quicker than you. As for the underlying problem, HTTPS was designed for commerce, not encrypted HTTP connections. That's the problem here. Too bad commerce is what most people use HTTPS for, so there's not much chance of getting that changed. In my ideal world, firefox would have an easy-to-reach "I'm connecting to my own server so STFU" button right next to the "GET ME OUT OF HERE!" one on the "YOU SHALL NOT PASS" screen. Or maybe I'm getting delirious. –  marcusw Jan 7 '11 at 4:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.