Using certificates is all about trust and encryption. On internet the security is fundamental, and trusting someone you don’t know personally is clearly a difficult task to accomplish. In technology, that trust is accomplished by the use of certificates and Certificate Authorities (CA). In simple words, a CA is an organization or company globally recognized that validates and signs our certificate requests. You may think about a CA as the top hierarchy level in terms of certificate generation.

Usually commercial companies generate certificate requests, and send those certificate requests to one of these CAs, the CA will then validate the information in the request and if everything is fine the CA will sign it and return the signed certificate to the requester, that company can then use it in their website, email server or whatever they requested the certificate for. When an user connects to one of the services offered by the company (i.e. a website), the browser receives the signed certificate, it quickly looks at the details including the CA signature, and if everything looks good the browser will happily connect to the service, normally through an encrypted connection, but if there’s a problem with the certificate it will most likely stop and let the user know about the problem. These problems vary from CAs not recognized by the browser to errors in the certificate data.

If general public accessibility is not a concern, the company may also setup their own internal network (intranet) CAs and push those CA certificates to all the computers in that network through some corporate technologies like Active Directory. The internal CAs will only be recognized by the computers in that network, and that’s exactly the goal.

The browsers are capable of identifying and validating a CA signature in the website certificate they receive because they come with a list of globally recognized CA certificates already preinstalled. That’s correct, the CAs also have a certificate of their own, self-signed, that they share with the companies that develop internet browsers so it gets pre-installed on the user’s computer when the browser is installed, in other words you may not know those companies, but your computer may already trust them!

And finally, home network users may also generate their own tiny CAs, and level up the security of their network if done right through the use of tools such as OpenSSL.

There are many details behind the process of generating certificate requests and signing them for a highly secure environment, in this tutorial will go over the steps to setup a basic functional certificate for OpenWRT on a home network, which will include generating your own CA certificate as well.

Requirements

• OpenSSL: General-purpose cryptography library, we will use it to generate all the certificates.
• SSH: This is how we are going to connect to our OpenWRT router.
• A main client computer. I’ll use a MS Windows 10 computer.
• A basic understanding of the command line.
• (Optional) SFTP/SCP: You may use the console or GUI tool. I normally use WinSCP (For MS Windows). This tutorial won’t go over the details of how to use SFTP.
• (Optional) A second client computer with OpenSSL to generate the certificates. It’s usually considered safer to use another computer, even more secure if it’s an standalone computer (disconnected from any network), to generate the CA certificate and sign the certificate requests, nonetheless for most of us that’s probably too much, so you can always build a VM with Linux, use your everyday computer or as the last option generate all your certificates directly on your OpenWRT router. In any option, I’d recommend you move your CA files to an offline storage device (usb key) for better security and to sign any other certificates you may want to generate in the future.

Installation Steps

OpenWRT Router

1. Upgrade all packages:

opkg update
opkg list-upgradable

Note: OpenWRT recommends that you upgrade every package individually. You may try the following command to update all packages at the same time, but keep in mind that if one of the packages fails you may have to reinstall OpenWRT:

opkg list-upgradable | cut -f 1 -d ' ' | xargs opkg upgrade

2. Install SSL utils and LuCi. Openssl-util is only required if you plan to generate certificates on the router:

opkg install openssl-util luci-ssl luci-app-uhttpd

Note: In this tutorial we are using uhttpd and not nginx. I personally found uhttpd better integrated into LuCI at this time, but if you still want to try nginx (opkg install luci-ssl-nginx) keep in mind that the certificate files for nginx are located under /etc/nginx/. This tutotial is for uhttpd.

3. Install the SFTP service on the router if you would like to manually copy the certificate and private key files from your computer to the router. You will also have the option of doing it through LuCI if you don’t feel comfortable with SFTP, in that case skip this step:

opkg install openssh-sftp-server

4. Restart uhttpd service:

service uhttpd restart

Second client computer (or your everyday computer, or OpenWRT console if you installed openssl-util)

1. Create a Certificate Authority (CA). This Certificate Authority will be used to sign all certificate requests in your network, once you create it you want to keep the CA files in a secure offline storage device (i.e. usb key) that you only connect to your computer when you need to sign a new certificate request. If you are extremely concerned about your CA security, you may even want to use a standalone computer only for signing certificate requests, but for most cases an offline storage device should be enough.

openssl genrsa -des3 -out ca.key 4096

openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.crt

It will ask for some information, just fill out the form with your information. Keep in mind that “CN” is the name that will show up in most places when you review the certificate, so you want to use a name that makes sense for you.

i.e.
C = MyCountry
ST = MyState
L = MyCity
O = MyHome
OU = Home Internet
CN = MyHome CA
Email = Your Email or leave blank

2. Now that your CA is ready, let’s focus on the router certificate. Create the following 2 files on your current working directory (i.e. /home/user). Make sure you update the values with your own information, especially the DNS and IP in v3.ext.

myconfig.conf

[req]
distinguished_name = req_distinguished_name
prompt = no
[req_distinguished_name]
C = MyCountry
ST = MyState
L = MyCity
O = MyHome
OU = Home Internet
CN = MyHome Router

v3.ext

authorityKeyIdentifier=issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = openwrt.lan
DNS.2 = another_alternate_name.lan
IP.1 = x.x.x.x

3. Create your router private key and certificate signing request. Note that this is a request, not the actual certificate, we are going to ask the CA (uor CA), to sign the router certificate:

openssl genrsa -out router.key 4096
openssl req -new -key router.key -config myconfig.conf -out router.csr

Or in one line:

openssl req -new -nodes -out router.csr -newkey rsa:4096 -keyout router.key -config myconfig.conf

Verify your request looks correct:

openssl req -in router.csr -noout -text -verify

4. Sign and generate the router certificate:

openssl x509 -req -days 730 -extfile v3.ext -in router.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out router.cer

Main client computer (MS Windows)

1. If you created the CA certificate on another computer, make a local copy (ca.crt) using SFTP/SCP.

2. Install the CA Certificate:

• Select Run from the Start menu, and type certmgr.msc.
• Go to “Root CA Certificates” > Certificates.
• Right click on Certificates, Select All Tasks > Import.
• Normally all the defaults are fine just complete the wizard.
• Once complete, you should see the certificate listed under “Root CA Certificates” > Certificates.

OpenWRT Router

1. Install Router certificate and key. For this step, you can either use the console or the web interface (LuCI):

Console:

• Copy both files router.cer and router.key to /etc/ssl on the router using SFTP.
• Update the following lines in /etc/config/uhttpd:

option redirect_https '1'
list listen_http '10.84.1.1:80'
list listen_https '10.84.1.1:443'
option cert '/etc/ssl/router.cer'
option key '/etc/ssl/router.key'

Web interface (LuCi):

• Go to Services > uHTTPd
• In the “HTTPS Certificate” field, search for and select /etc/ssl/router.cer
• In the “HTTPS Private Key” field, search for and select /etc/ssl/router.key
• Click on “Save and apply”.

2. Restart uhttpd:

service uhttpd restart

3. That’s it! Now you may refresh the browser and see your new Certificate working!

Optional, but highly recommended

If you are interested in including your certificate and key files as part of your standard router backup, just follow these steps in LuCi:

• Go to System > Backup/Flash Firmware.
• Go to the Configuration tab, and add both files to the list of files to backup:

/etc/ssl/router.crt
/etc/ssl/router.key

• Click on Save.

Now if you create a backup and restore that backup, your certificate and private key files will be restored in addition to all other configuration files.