certificate override feature request

[Calisro]

Merlin, would you consider allowing us to override the default certificate for https with our own by placing override config files in jffs/config? I've done what is in this link and it works but my problem is:

1) it takes a large amount of nvram to hold a quality cert and ca.
2) It would be nice if I have to factory reset, that it would pick up my new cert easily with my replaced jffs configs rather than messing with doing it manually.

reference:
https://gist.github.com/davidbalbert/6815258

I'm sure I can just hack my own startup script to fix it after a factory reset but the nvram issue remains.

 

[Calisro]

After I typed this, I realized I can just add 3 lines to one of the startup scripts and its done without using nvram. This is probably safer than messing with asus's code.

cp /jffs/key.pem.home /etc/key.pem
cp /jffs/cert.pem.home /etc/cert.pem
service restart_httpd

 

[cosmoxl]

good move - key is only 1024 bit RSA (.55 firmware)

can you point me to a good place where I can learn how to generate my own cert and key for this?

 

[Calisro]

good move - key is only 1024 bit RSA (.55 firmware)
can you point me to a good place where I can learn how to generate my own cert and key for this?

Yes, you can use https://www.startssl.com/ to create a free certificate for a domain name that you own.

First, use the StartSSL™ Control Panel to create a private key and certificate and transfer them to your server. Then execute the following steps (if you use a class 2 certificate replace class1 by class2 in the instructions below):

Decrypt the private key by using the password you entered when you created your key:
openssl rsa -in /tmp/ssl.key -out /jffs/key.pem.home

Fetch the Root CA and Class 1 Intermediate Server CA certificates:
wget http://www.startssl.com/certs/sub.class1.server.ca.pem

Create a unified certificate from your certificate (downloaded from startssl) and the CA certificates:
cat ssl.crt sub.class1.server.ca.pem > /jffs/cert.pem.home

cp /jffs/key.pem.home /etc/key.pem
cp /jffs/cert.pem.home /etc/cert.pem
service restart_httpd

 

[cosmoxl]

Thanks!