4 ms·

The solution would be create a dns record for something linke newinstall.openwrt.net and use that to to generate a certificate from letsencrypt and include that

by znpy 6y ago

The solution would be create a dns record for something linke newinstall.openwrt.net and use that to to generate a certificate from letsencrypt and include that into the openwrt builds. Such builds would be rebuilt every 2.5 months and would have a lifespan of 2 months. The only problem I see with that is that now you have to setup ci and automated build for a vast number of targets (which i'm not sure if exists already). The public dns record would then have 192.168.1.1 as A record (or whatever the default is in openwrt)

nahuel0x 6y ago
not possible, letsencrypt and the rest of CA's can't emit an SSL certificate for a private address.
tsimionescu 6y ago
You can't distribute the private key of a certificate in a software package, it would immediately get used for MITM.
captainmuon 6y ago
Wouldn't LetsEncrypt have to revoke that certificate according to the rules? And I wonder, is having the private key sufficient to eavesdrop on a SSL connection? If that was the case, this wouldn't help against attackers.
- tialaramex 6y ago
  Having a private key is only sufficient to passively eavesdrop TLS 1.2 (and earlier) RSA kex which is not going to happen with any halfway modern browser. You could actively MITM passthrough with the private key on any version, because in this and most cases HTTPS is not mutually authenticated, so the OpenWrt server doesn't know it is talking to your eavesdropping system rather than the web client.
- hannob 6y ago
  Yes. They even have an API to do so, you can revoke any Let's Encrypt certificate with certbot if you have the private key.
tialaramex 6y ago
Don't do this for any published software. If you want to build your own in-house systems this way knock yourself out, but for anything published this is not at all safe as I explain in the linked LWN comments. If anybody other than the subscriber has the private key they can (and should) revoke the certificate. With Let's Encrypt you can even trivially automate this, fetch the new build, extract the private key, do the ACME revocation call with the signature from that key as proof and the certificate is revoked. This is also a violation of the subscriber agreement for any public CA, it's unlikely they'll do anything about that beyond revoking the certificate, but they might, especially if you keep doing this after being told not to.
heavyset_go 6y ago
> Such builds would be rebuilt every 2.5 months and would have a lifespan of 2 months. Sounds like a fast way to hit flash storage's write cycle limit and corrupt the device. The devices that OpenWRT targets mostly have flash memory that have limited amounts of write cycles[1] before the memory fails. [1] https://openwrt.org/docs/techref/flash https://openwrt.org/docs/techref/flash

by znpy 6y ago

nahuel0x 6y ago

not possible, letsencrypt and the rest of CA's can't emit an SSL certificate for a private address.

tsimionescu 6y ago

You can't distribute the private key of a certificate in a software package, it would immediately get used for MITM.

captainmuon 6y ago

Wouldn't LetsEncrypt have to revoke that certificate according to the rules? And I wonder, is having the private key sufficient to eavesdrop on a SSL connection? If that was the case, this wouldn't help against attackers.

tialaramex 6y ago
Having a private key is only sufficient to passively eavesdrop TLS 1.2 (and earlier) RSA kex which is not going to happen with any halfway modern browser. You could actively MITM passthrough with the private key on any version, because in this and most cases HTTPS is not mutually authenticated, so the OpenWrt server doesn't know it is talking to your eavesdropping system rather than the web client.
hannob 6y ago
Yes. They even have an API to do so, you can revoke any Let's Encrypt certificate with certbot if you have the private key.

tialaramex 6y ago

Don't do this for any published software. If you want to build your own in-house systems this way knock yourself out, but for anything published this is not at all safe as I explain in the linked LWN comments. If anybody other than the subscriber has the private key they can (and should) revoke the certificate. With Let's Encrypt you can even trivially automate this, fetch the new build, extract the private key, do the ACME revocation call with the signature from that key as proof and the certificate is revoked. This is also a violation of the subscriber agreement for any public CA, it's unlikely they'll do anything about that beyond revoking the certificate, but they might, especially if you keep doing this after being told not to.

heavyset_go 6y ago

> Such builds would be rebuilt every 2.5 months and would have a lifespan of 2 months. Sounds like a fast way to hit flash storage's write cycle limit and corrupt the device. The devices that OpenWRT targets mostly have flash memory that have limited amounts of write cycles[1] before the memory fails. [1] https://openwrt.org/docs/techref/flash https://openwrt.org/docs/techref/flash