3

littleblackbox is publishing "private keys" that are accessible on publicly available firmwares. Debian calls these "snake-oil" certs. Most of these routers are securing their HTTPS certs with these, and as I think about it, I've never seen one of these internal admin websites with certs that wasn't self signed.

Given a webserver on IP 192.168.1.1, how do you secure it to the point that Firefox doesn't offer warnings (and is still secured)?

2 Answers 2

2

The answer depends entirely on the product you're using. If it allows you to install your own SSL certificate, then install one from a CA that's trusted by your browser (possibly your own CA).

If you can't replace the self-signed certificate on the router, you're mostly SOL.

I'm not sure there's much real risk here. The attack profile is pretty small...someone sniffing the network at the right time can get your router's administrative password, but the chances of this happening seem pretty small unless you're frequently authenticating to your router.

3
  • Lets assume I can install a new SSL cert. What should I use for the domain? Surely CAs won't sign an IP address.
    – jldugger
    Jan 6, 2011 at 15:57
  • @jldugger: I think most will sign a certificate with an IP address as the Common Name.
    – DerfK
    Jan 6, 2011 at 16:14
  • 3
    Also since this is presumably your own environment you can establish a hostname for the router and use that...and, again, you can just create your own CA and configure your browser to trust it, and then you can call things whatever the heck you want. For example, debian-administration.org/articles/618.
    – larsks
    Jan 6, 2011 at 16:28
1

I assume that firefox is complaining because the cert is self-signed, which is how things usually go.

The way to do this is to either add an exception in FireFox or get an actual valid cert. Last I checked, they ran about $700. And by the way, procuring a valid cert for "192.168.1.1" is impossible on account of it being a local IP.

Simply adding a firefox exception should be fine, though...things will still be encrypted, you just won't be safe from man-in-the-middle attacks.

3
  • You pay 700 dollars for certs? I'm in the wrong business!
    – jldugger
    Jan 7, 2011 at 4:26
  • Also, it's not just about shutting up firefox, it's also about fixing the underlying problems better. Thats why I asked this question on serverfault, since a lot of the same problems exist in IT. My fault for adding the word "home" I suppose.
    – jldugger
    Jan 7, 2011 at 4:28
  • No, I'm not paying for certs at that price any quicker than you. As for the underlying problem, HTTPS was designed for commerce, not encrypted HTTP connections. That's the problem here. Too bad commerce is what most people use HTTPS for, so there's not much chance of getting that changed. In my ideal world, firefox would have an easy-to-reach "I'm connecting to my own server so STFU" button right next to the "GET ME OUT OF HERE!" one on the "YOU SHALL NOT PASS" screen. Or maybe I'm getting delirious.
    – marcusw
    Jan 7, 2011 at 4:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .