Differences

This shows you the differences between two versions of the page.

--- custom_ssl_cert_local_cert_authority [2025/11/25 22:36] – [Upload the Custom Certificates / Key to the Router and Write them to NVRAM] hogwild
+++ custom_ssl_cert_local_cert_authority [2025/11/26 00:15] (current) – [Set up a Custom SSL Cert - Notes and Troubleshooting] hogwild
@@ Line 448: / Line 448: @@
 ==== Upload the Custom Certificates / Key to the Router and Write them to NVRAM ====
- \\  Using the secure copy command (and legacy protocol), copy the: "[[FT.key.pem]]" file and the: ""[[FT.cert.pem]]" file from the Intermediate CA to the root user FreshTomato home directory (whose default name is assumed to be: "FT") \\   \\   \\  ''scp -O /root/ca/intermediate/client_keys/FT.key.pem /root/ca/intermediate/newcerts/FT.cert.pem root@FT'' \\   \\   \\   \\   \\  Run the SSH command to connect via SSH to the root account on the host router named: "FT": \\   \\   \\  ''ssh root@FT'' \\   \\   \\   \\   \\  Rename the file: "[[FT.key.pem]]" file to: "key.pem": \\   \\   \\  ''mv [[FT.key.pem]] key.pem'' \\   \\   \\   \\   \\  Rename the file: "[[FT.key.pem]]" to cert.pem: \\   \\   \\  ''mv [[FT.cert.pem]] cert.pem'' \\   \\   \\   \\   \\  Concatenate the contents of the "key.pem" and "cert.pem" files and write the combined content into new file: "/etc/server.pem": \\   \\   \\  ''cat key.pem cert.pem > /etc/server.pem'' \\   \\   \\   \\   \\  Copy the "./cert.pem" file to the "/etc" directory: \\   \\   \\  ''cp ./cert.pem /etc/cert.pem'' \\   \\   \\   \\   \\  Copy the "./key.pem" file to the "/etc" directory: \\   \\   \\  ''cp ./key.pem /etc/key.pem'' \\   \\   \\   \\   \\  Run the stream text editor, make it open the "cert.pem" file in place, overwriting any changes and cutting off content after the words: "END CERTIFICATE": \\   \\   \\  ''sed -i "/END CERTIFICATE/q" /etc/cert.pem'' \\   \\   \\   \\   \\  Run the tar command and compress the "cert.pem" and "key.pem files into the "/tmp/cert.tar" file, preserving all /path/ information) \\   \\   \\  ''/bin/tar -C / -cf /tmp/cert.tar etc/cert.pem etc/key.pem '' \\   \\   \\   \\   \\  Run the gzip archive tool to further compress the "cert.tar" file (making it into a "tar.gzip" file): \\   \\   \\  ''/bin/gzip -f /tmp/cert.tar'' \\   \\   \\   \\   \\   \\  Encode the "/tmp/cert.tar.gz" tarball archive of SSL certificate files, encode it in base64 using OpenSSL, remove any newline characters from the encoded string, and then set this base64-encoded string as the value of the "https_crt_file" variable in NVRAM. \\   \\   \\  ''nvram set https_crt_file="$(/usr/sbin/openssl enc -base64 < /tmp/cert.tar.gz | tr -d '\n')"'' \\   \\   \\   \\   \\  Commit all the changes to NVRAM: \\   \\   \\  ''nvram commit'' \\   \\   \\   \\   \\  Finally, restart the HTTP daemon: \\   \\   \\  ''service httpd restart'' \\   \\   \\   \\  The "intermediate.cert.pem" file is now ready to be imported into your browser. The author uses Brave, in which you can import the file via "Trusted certificates", (not "Intermediate certificates"). \\   \\  The process is now complete. Now, you should be able to access your FreshTomato web interface using the custom certificates you created with your own CA. If something isn't working, review all steps and double-check that they were properly completed. \\   \\   \\
+ \\  Using the secure copy command (and legacy protocol), copy the: "FT.key.pem" file and the: ""FT.cert.pem" file from the Intermediate CA to the root user FreshTomato home directory (whose default name is assumed to be: "FT") \\   \\   \\  ''scp -O /root/ca/intermediate/client_keys/FT.key.pem /root/ca/intermediate/newcerts/FT.cert.pem root@FT'' \\   \\   \\   \\   \\  Run the SSH command to connect via SSH to the root account on the host router named: "FT": \\   \\   \\  ''ssh root@FT'' \\   \\   \\   \\   \\  Rename the file: "FT.key.pem" file to: "key.pem": \\   \\   \\  ''mv FT.key.pem key.pem'' \\   \\   \\   \\   \\  Rename the file: "FT.key.pem" to cert.pem: \\   \\   \\  ''mv FT.cert.pem cert.pem'' \\   \\   \\   \\   \\  Concatenate the contents of the "key.pem" and "cert.pem" files and write the combined content into new file: "/etc/server.pem": \\   \\   \\  ''cat key.pem cert.pem > /etc/server.pem'' \\   \\   \\   \\   \\  Copy the "./cert.pem" file to the "/etc" directory: \\   \\   \\  ''cp ./cert.pem /etc/cert.pem'' \\   \\   \\   \\   \\  Copy the "./key.pem" file to the "/etc" directory: \\   \\   \\  ''cp ./key.pem /etc/key.pem'' \\   \\   \\   \\   \\  Run the stream text editor, make it open the "cert.pem" file in place, overwriting any changes and cutting off content after the words: "END CERTIFICATE": \\   \\   \\  ''sed -i %%"%%/END CERTIFICATE/q%%"%% /etc/cert.pem'' \\   \\   \\   \\   \\  Run the tar command and compress the "cert.pem" and "key.pem files into the "/tmp/cert.tar" file, preserving all /path/ information) \\   \\   \\  ''/bin/tar -C / -cf /tmp/cert.tar etc/cert.pem etc/key.pem '' \\   \\   \\   \\   \\  Run the gzip archive tool to further compress the "cert.tar" file (making it into a "tar.gzip" file): \\   \\   \\  ''/bin/gzip -f /tmp/cert.tar'' \\   \\   \\   \\   \\   \\  Encode the "/tmp/cert.tar.gz" tarball archive of SSL certificate files, encode it in base64 using OpenSSL, remove any newline characters from the encoded string, and then set this base64-encoded string as the value of the "https_crt_file" variable in NVRAM. \\   \\   \\  ''nvram set https_crt_file="$(/usr/sbin/openssl enc -base64 < /tmp/cert.tar.gz | tr -d '\n')"'' \\   \\   \\   \\   \\  Commit all the changes to NVRAM: \\   \\   \\  ''nvram commit'' \\   \\   \\   \\   \\  Finally, restart the HTTP daemon: \\   \\   \\  ''service httpd restart'' \\   \\   \\   \\  The "intermediate.cert.pem" file is now ready to be imported into your browser. The author uses Brave, in which you can import the file via "Trusted certificates", (not "Intermediate certificates"). \\   \\  The process is now complete. Now, you should be able to access your FreshTomato web interface using the custom certificates you created with your own CA. If something isn't working, review all steps and double-check that they were properly completed. \\   \\   \\
 ===== Set up a Custom SSL Cert - Notes and Troubleshooting =====
- \\
-Download the two configuration files needed to create the Custom Certificate Authority here: \\
+ \\ Download the two configuration files needed to create the Custom Certificate Authority here: \\   \\   \\
- \\
- \\
   - {{ca.openssl.cnf.zip}}
   - {{intermediateca.openssl.cnf.zip}}
- \\
- \\
+ \\   \\ The OpenSSL ccparam subcommand doesn't directly support adding a password to a key. However, it can be piped back through OpenSSL to give it an extra layer of protection. For example, typing the following will generate an elliptical curve key using the prive256v1 algorithm, and then pipe it directly to the second command. The second command, "openssl ec -aes256 -out yourkey.pem" takes the output from the first one, (an elliptical curve key), encrypts it, prompts you for a password to protect it and then outputs the final result to file: "yourkey.pem".\\   \\ ''openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out yourkey.pem''
-The OpenSSL ccparam subcommand doesn't directly support adding a password to a key. However, it can be piped back through OpenSSL to give it an extra layer of protection. For example, typing: \\
  \\
-''openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out yourkey.pem'' \\
- \\
+ \\ Since r2025.3, FreshTomato doesn't require the CN to match the Hostname. The following steps will allow you test your setup to verify this. However, please note that testing this could cause FreshTomato to overwrite your custom cert. If it does happens, upload your certificate again and SSH will still function fine. \\   \\
- \\
- \\
-Since r2025.3, FreshTomato doesn't require the CN to match the Hostname. The following steps will allow you test your setup to verify this. However, please note that testing this could cause FreshTomato to overwrite your custom cert. If it does happens, upload your certificate again and SSH will still function fine. \\
- \\
   * In the web interface, go to the [[admin_access|Admin Access]] menu and check the CN under "SSL Certificate". \\ \\
   * Connect via SSH to FreshTomato and run the following commands:
@@ Line 476: / Line 472: @@
   * When the router is accessible again you'll notice that the certificate is still working fine. \\ Go back to the [[admin_access|Admin Access]] page and you will see the CN is now "some.random.thing" \\ \\
   * If you clicked "Save" at the bottom of the page, or reboot the router from the web interface, your cert would be overwritten. \\ \\
   * At this point you can go back to SSH and change back your CN and commit or, of test it further. \\
- \\
- \\
+ \\   \\   \\
- \\

FreshTomato Wiki

User Tools

Site Tools

Differences

Page Tools