5

I have a TP-Link router and I tried accessing the configuration page (192.168.0.1) via https, but could not. It only works via http.

Does this happen with any router or is it just mine (or maybe just TP-Link)?

I've googled this issue a lot and I can't seem to find anything related to this subject

5
  • The router's firmware needs to have that feature. Have you looked in the settings? Jan 9, 2016 at 16:31
  • I can't seem to find anything related to https in the settings. Jan 9, 2016 at 16:36
  • What actually happens when you try to access via HTTPS? Does it not resolve or do you simply get a certificate warning? Many routers use self-signed certs so the browser blows up with the necessary warnings, but you can go "advanced" and proceed over an HTTPS/encrypted connection if you want.
    – MrWhite
    Jan 9, 2016 at 18:20
  • 1
    Having said that, I also have a TP-LINK router and that is also not available over an HTTPS connection.
    – MrWhite
    Jan 9, 2016 at 18:40
  • @w3dk It says "unable to connect" when I try over https Jan 10, 2016 at 10:09

3 Answers 3

2

If tp-link doesn't support HTTPS

You can look into dd-wrt which supports HTTPS

Following list has supported devices by dd-wrt http://www.dd-wrt.com/wiki/index.php/Supported_Devices

If your device is supported you can flash it and install DD-WRT

2
  • I can't seem to find "enable https" or anything similar in the settings. It's possible that it may not be available. Jan 9, 2016 at 16:53
  • Which certificate authority does DD-WRT use to obtain a certificate? Jun 30, 2018 at 17:02
2

TP-Link (as with many or most other home router manufacturers) are pretty lame on security. Along with this lack of https, their password limitations for your router admin account, is maximum 14 character alphanumeric, (thus crackable, arguably, and certainly artifically-limited in length). Sometimes they have weird limitations on the ASCII characters for WiFi passwords, too, even though the WiFi standard doesn't have these limitations (IIRC). The https is not such a big deal, as typically it would be a self-signed certificate (and thus already-leaked all over the web and MiTM-able for any half-serious attacker, as far as I know). Sorry this isn't a solution, but the solution is in new third-party firmware (and testing it to see that it does what it claims to do, security-wise).

1
  • I think it depends on which TP-Link. I have one 6 years old and I can set password using alphanumerics and special chars like @&-% etc. 14 chars length with special chars makes a very robust pass.
    – Jeffz
    Oct 22, 2019 at 19:04
1

HTTP and HTTPS aren't interchangeable simply because one works. They are two different protocols, whilst both use HTTP to transfer data, HTTPS does this over a secure sockets layer.

Whilst the difference looks like a simple addition of the letter S, a lot more is going on. The server needs to be able to provide this particular service, many routers do not as the data isn't usually important enough to warrant the additional encryption (the most important data it'll be handling for most end users would be a Wi-Fi PSK, or an ADSL password).

As such, unless you're using a router that happens to have this somewhat trivial level of web management security, or it's an enterprise level router, you won't have this feature.

Just so you're aware, you will get a page not found message, as:

HTTP, by default, is listening on port 80. HTTPS, by default, listens on port 443.

When sites use HTTPS, your browser will interpret this to mean https://192.168.X.X:443, as opposed to http://192.168.X.X:80.

As it's not listening on port 443, there's nothing to connect to, so it returns that no page is available.

As for what you can do about it, there are a few alternative firmwares, such as DD-WRT, Tomato or Open-WRT which may provide what you want.

4
  • 3
    "many routers do not as the data isn't usually important enough to warrant the additional encryption". I beg to differ. If someone is connected to the router's WiFi and I try to change the password of this WiFi by connecting to the router's configuration page via http, then that someone can easily sniff the router's administration page password. After that, that someone can sniff the new password for the WiFi that I have just put. I have seen this with my own eyes. This is exactly why I'm interested in this topic. Don't tell me that accessing my router via https is not important. Jan 9, 2016 at 16:48
  • @conectionist Please note the qualifier 'usually', along with 'many do not'. I'm stating that, most consumer grade routers do not include it, because usually this is not a problem. I've told you why you can't find this feature, not that you're wrong to want it.
    – Jonno
    Jan 9, 2016 at 16:52
  • I understand. Thank for the explanation and the alternative firmware suggestions. Jan 9, 2016 at 17:02
  • 1
    If WiFi sniffing is a concern, it might be best to use a wired connection to configure routers that don't support https. Granted, sometimes that's not practical. But if it is, it's going to be the most secure. Jan 9, 2016 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .