6

I have an Arris Cable Modem for comcast. Arris-Surfboard SBG6700-AC

enter image description here

I last logged in to the admin console maybe a week ago: it was fine. I did not make any configuration changes. A couple days later Comcast made some upstream configuration changes that were pushed to the router. That happens with some regularity - also without issue.

But now the router admin console is giving security errors? I briefly saw something about TLS 1.0 and TLS 1.1 but can not reproduce the error message.

Safari :

enter image description here

enter image description here

enter image description here

Chrome :

enter image description here

How can I resolve this issue since I can not get into the admin console? If I do a factory reset that will mess up many settings and probably a half day or more to get back up and running.

9
  • 1
    I'd say first port of call would be your ISP. TLS1.2 is the current industry standard, older versions are deprecated if not completely unsupported.
    – Tetsujin
    Apr 26, 2021 at 16:29
  • @Tetsujin Pls make that an answer: i was about to call Comcast to see if they can diagnose but your comment give more confidence in that being the right way Apr 26, 2021 at 16:40
  • Dropped in as an answer - I don't really have much to flesh it out with, so it looks a bit sparse ;)
    – Tetsujin
    Apr 26, 2021 at 16:44
  • The behavior you describe in your screenshots matches what I would expect if you attempt to visit an insecure website over HTTPS. Unless you generated a certificate, then your connection to your modem, is unlikely suppose to be encrypted HTTP.
    – Ramhound
    Apr 26, 2021 at 16:49
  • There was a trick for chrome, unable to find any resource now, but you can try typing thisisunsafe (all one word), followed by Enter. Apr 27, 2021 at 1:46

5 Answers 5

6

If you start to see TLS 1.0 and TLS 1.1 errors now, this is due to browsers dropping support for these old protocols recently. Or at least disabling them per default. Not too much of an issue locally and for example firefox still allows you to override, chrome doesn't.

For Chrome the cited blog explicitly states:

In Chrome 81, which will be released to the Stable channel in March 2020, we will begin blocking connections to sites using TLS 1.0 or 1.1, showing a full page interstitial warning:

For Firefox the blog sais:

So, expect Firefox 74 to offer TLS 1.2 as its minimum version for secure connections when it ships on 10 March 2020. We plan to keep the override button for now; the telemetry we’re collecting will tell us more about how often this button is used.

So the solution using firefox may be temporary.

Update by the asker Firefox does in fact work: showing it here

enter image description here

Another update There appears to be a potentially more long-lasting/permanent solution: take a look at this answer below https://superuser.com/a/1710034/212970

3
  • 1
    Thx for that tip about firefox : that works! Apr 26, 2021 at 17:31
  • 2
    Chrome and Firefox dropping support anything below TLS 1.2 isn't new behavior though. So unless the browsers on the author's machine just happened to be updated, while enabling TLS 1.1 and lower is a solution, it's likely the Arris device that changed not the browsers being updated to a version that doesn't support 1.1 and below.
    – Ramhound
    Apr 26, 2021 at 17:40
  • I changed accepted answer to another one just added that appears to show how to handle this for later/going forward versions of FF. Actually i think I will instead put a pointer to it Mar 15, 2022 at 22:53
7

There was a trick for Chrome. You can try typing thisisunsafe (all one word), followed by Enter.

You can type that anywhere on that warning webpage. You won't be able to see the letters on screen when you type but it should still work. You may have to click on a blank spot on the page to put focus away from the address bar.

Just note this is trick was probably just a way for Chrome developers to bypass the warning so it may change in future versions without notice. Also, this is potentially dangerous because you could put yourself at risk of a man-in-the-middle attack. Exercise caution when doing this. The router's firmware probably needs to be updated and you may need to do this to get access.

Cross-site reference: https://stackoverflow.com/questions/58802767/no-proceed-anyway-option-on-neterr-cert-invalid-in-chrome-on-macos

1
3

I'd say first port of call would be your ISP.
TLS1.2 is the current industry standard, older versions are deprecated if not completely unsupported.

6
  • 4
    There is no decent modern solution for securing SOHO-market LAN-accessible resources: Publicly trusted TLS certificates can only be issued to publicly-accessible websites, which a home router's control panel definitely isn't. Home users aren't going to want to (or know how to) set-up their own PKI and install their own certificate either. And finally, we definitely cannot trust hardware makers and ISPs as root CAs.
    – Dai
    Apr 27, 2021 at 6:23
  • It only needs a privately-trusted certificate to access the gateway. The ISP ought to be responsible for their hardware not supporting TLS1.2 & would be the ones to fix it, or replace the outmoded equipment.
    – Tetsujin
    Apr 27, 2021 at 6:38
  • That doesn't solve the problem though. What is the basis for the trust-relationship you're proposing? How would the certificate be generated? How can we ensure those certificates won't be abused? How can software install a new certificate for (or into) an initially untrusted device? A common pre-installed certificate on the modem/router won't work either because it's impossible to keep private-keys secret when the hardware is out in the open - and a device-specific certificate won't work because it won't be initially trusted. Hence why there is no solution right now.
    – Dai
    Apr 27, 2021 at 6:41
  • "No solution"?? My gateway has been TLS1.2 only for years. It's been so long I can't remember when older TLS was deprecated. Though I use my own router not the ISP's, if 3 million ISP routers suddenly started rejecting users accessing the interface there would be uproar. It would have hit the newspapers.
    – Tetsujin
    Apr 27, 2021 at 7:12
  • 1
    @Tetsujin Using privately trusted certificates for ISPs opens a huge can of worms, though. Requiring the user to accept a certificate is used in many areas to allow the ISP or government to do a man in the middle attack. And it's unclear how to do so with proper public trusted certificates, since those have to be renewed over time. I'm genuinely not sure how TLS is managed at all in routers, but it would seem to have to be in a suboptimal manner.
    – trlkly
    Apr 27, 2021 at 20:21
2

I had the issue and I solved it as follows:

In Firefox, open about:config (Type in address bar)

Then search for security.tls.version.min and change its value to 1

Now, you can access your modem. You may get a warning message. Using advanced you can continue and take the risk (There is no risk)

Finally, after you finish your task, change back security.tls.version.min to 3

0
1

I believe you can click Advanced to show an option to continue to unsafe sites in Chrome. Generally not a good idea but in a case like this where it's something you know isn't a threat, it should be fine.

2
  • Yea you're right (well in the past that was true) - but now Chrome will not even let me proceed. Apr 26, 2021 at 18:04
  • @StephenBoesch Maybe try typing "thisisunsafe" while the page is in focus? Apr 27, 2021 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .