How to get rid of LuCI HTTPS certificate warnings

Do you like the security of using LuCI-SSL (or Luci-SSL-OpenSSL), but sick of the security warnings your browser gives you because of an invalid certificate?

With these instructions, you can generate your own self-signed certificate, which your browser will accept as valid.

One new headache was that, browsers usually only look at one key part of a self-signed certificate, the CN (common name). However, starting with Chrome version 58, it not only looks at the CN (common name) in the certificate, but also at the SAN (subject alt name or DNS name), which makes generating a certificate more complicated than before. You might have even had a certificate you made yourself, that worked until recently, stop working when Chrome 58 was released and most likely automatically updated and installed.

So, to get rid of the annoying “Warning, this is an insecure site, do you want to proceed?” warning messages, and other similar messages from other browsers, proceed with the following.

I know it looks long, but it's easy and goes fast. Should take about 10 minutes tops.

1. Connect via SSH
2. Install the openssl-util and LuCI uhttpd packages. This is required to generate a new certificate in the way you want it to be, and to be able to easily tell LuCI how to use it.
   

   opkg update && opkg install openssl-util luci-app-uhttpd

3. Create /etc/ssl/myconfig.conf with the following content:
   

   myconfig.conf

   [req]
   distinguished_name  = req_distinguished_name
   x509_extensions     = v3_req
   prompt              = no
   string_mask         = utf8only
    
   [req_distinguished_name]
   C                   = US
   ST                  = VA
   L                   = SomeCity
   O                   = OpenWrt
   OU                  = Home Router
   CN                  = luci.openwrt
    
   [v3_req]
   keyUsage            = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage    = serverAuth
   subjectAltName      = @alt_names
    
   [alt_names]
   DNS.1               = luci.openwrt
   IP.1                = 192.168.1.1

4. You can edit the values for C (country), ST (state), L (location), O (organization), OU (organization unit) to whatever you want.
   1. It's extremely important the values for CN and DNS.1 match, and also that IP.1 has the correct private IP address for the device.
      • Some of you might have a different IP, or you might access it via a hostname; the hostname should go in both CN and DNS.1 fields. The correct private IP address should go into IP.1.
5. Save the file and then navigate to /etc/ssl with the following command:
   

   cd /etc/ssl

6. Then issue the following command:
   

   openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout mycert.key -out mycert.crt -config myconfig.conf

   This will create two files, mycert.key and mycert.crt
   Alternatively you can create ECDSA certificate (to speedup key exchange phase) with the following command:
   

   openssl req -x509 -nodes -days 730 -newkey ec:<(openssl ecparam -name prime256v1) -keyout mycert.key -out mycert.crt -config myconfig.conf

7. In LuCI, go to Services → uHTTPd
   • In the field for HTTPS Certificate, select the file /etc/ssl/mycert.crt, or select “Upload file” to transfer it from your PC (mycert.crt)
   • In the field for HTTPS Private Key, select the file /etc/ssl/mycert.key, or select “Upload file” to transfer it from your PC (mycert.key)
   • Hit save and apply.
8. Restart uhttpd
   

   /etc/init.d/uhttpd restart

9. Now to make it so that those 2 files are saved when you make a backup, in LuCI, go to System → Backup/Flash Firmware, Click Configuration tab, then add /etc/ssl/mycert.crt & /etc/ssl/mycert.key
   • When you make and restore a backup, your cert and key will automatically be backed up and restored. The changes you made in LuCI → Services → uHTTPd will automatically be backed up because /etc/config/uhttpd is automatically backed up.
10. Hit Submit ( Or Save and Apply, depending on the LuCI Theme you're using )

• Now we have to get your computer to trust the certificate. They will get all browsers to work. However you need Chrome installed to do the process. Google how to do this for other operating systems. If you don't use Chrome, install it for now, and you can uninstall after. As I said, these instructions will get all browsers to accept the certificate (IE, Edge, Firefox, etc).
• Reload 192.168.1.1 (or however you access LuCI) in Chrome. Make sure you close and refresh the page after restarting uhttpd. Ignore the warning, and get to at least the login screen.
• Hit F12, click the security tab, click on view certificate, click the details tab, and click copy to file, just keep hitting next (don't change anything), and save (just name it, don't give it an extension as it'll be automatically added for you) the certificate somewhere easy to find. You can name it anything. Now close that window and the window that opened when you pressed F12.
  • In place of the last 2 steps above, you can pull /etc/ssl/mycert.crt off your router using other means such as SCP if you're a pro.
• Proceed below depending on your operating system

• In Chrome, go to settings, advanced, and click manage certificates.
• Select the Trusted Root Certification Authorities tab and click import.
• Just follow the prompts, find the location of where you saved the certificate, and just keep clicking next. (Don't change anything, make sure it says it's going to place it in the Trusted Root Certification Authorities store which it should have selected by default).
• Close all the windows and chrome and all your browsers. Next time you access LuCI, it will show the certificate and connection as valid and secure.

• Go back to cert location
  

  cd /etc/ssl

• Export the cert key pair to pfx:
  

  openssl pkcs12 -export -out mycert.pfx -inkey mycert.key -in mycert.crt

• Enter password 1234
• Download the pfx file to pc (using WinSCP for example)
• Run this powershell script as admin from pfx file location:
  

  $mypwd = ConvertTo-SecureString -String "1234" -Force -AsPlainText
  Import-pfxCertificate -FilePath mycert.pfx -Password $mypwd -CertStoreLocation "Cert:\LocalMachine\Root"

• This will add the certificate as trusted to the system store.
• IE Edge and Chrome will use this automatically.
• For Firefox either add the certificate to trusted certificates manually or enable using Windows trusted store in about:config by setting security.enterprise_roots.enabled to true

• You will need to install the libnss3-tools package first if you don't have certutil on your machine. Using your system's package manager, for example:

  apt-get install libnss3-tools

• The following command will add the certificate to your current user's NSS database. Make sure you are in the directory containing the mycert.crt file or adjust the -i parameter accordingly.

  certutil -d sql:$HOME/.pki/nssdb -A -t "CT,C,c" -n LuCI -i mycert.crt

• You can now restart your browser. The certificate errors when accessing LuCI should now be gone.

Enjoy!!

All the credit for the creation of this walk-through goes to @StarCMS who originally posted this in @Davidc502's thread. Minor changes and wiki formatting by @mariano.silva ( mariano.silva@gmail.com )