miaoer

There's no point in using the internal network; it feels good, but accessing it from the external network is another story.

Installing an SSL certificate on OpenWrt is not as difficult as imagined. My firmware did not compile OpenSSL, nor did it need to. During testing, I casually compiled it to access via https by default. The official version didn't use the internal network either, which felt a bit lacking.

To install an SSL certificate on OpenWrt, you first need an SSL certificate. Here, I used Goose Cloud (where I applied for a free SSL certificate, and I applied for one with an encryption algorithm of ECC 256.

Download; select Nginx as the certificate server type, and you only need the key .key and certificate .crt from the compressed package.

Use the built-in system file management of the firmware to find a place to put it; I chose /www, upload the two files, select the extraction location, and execute the upload.

Check if the upload was successful with the command cd /www && ls

If the firmware does not have file management, you can use your handy ssh tool scp to upload; here’s a demonstration of the command in Windows terminal scp C:\Users\【User】\Desktop\****.crt [email protected]:/www for reference.

Use vim to modify vi /etc/config/uhttpd

Copy

config uhttpd 'main'
        list listen_http '0.0.0.0:80'
        list listen_http '[::]:80'
        list listen_https '0.0.0.0:443'
        list listen_https '[::]:443'
        option redirect_https '0'
        option home '/www'
        option rfc1918_filter '1'
        option max_connections '100'
        option cert '/etc/uhttpd.crt'
        option key '/etc/uhttpd.key'

Replace /etc/uhttpd.crt in option cert '/etc/uhttpd.crt' with /www/****.crt
Replace /etc/uhttpd.key in option key '/etc/uhttpd.key' with /www/****.key

If you have a public IP, check if your ISP has blocked port 443; if so, change 443 to a port you prefer and replace '0.0.0.0:443' in list listen_https '0.0.0.0:443' with your preferred port.

Save by pressing Esc, Shift + ;(:) type wq to exit vim (:wq)

Then restart uhttpd with /etc/init.d/uhttpd restart

Test both the internal and external networks; remember to set up port mapping and DDNS domain resolution; IPv6 migration has no restrictions, and 443 can be accessed normally.

This way, the certificate installation is successful.

This article is synchronized and updated to xLog by Mix Space. The original link is https://www.miaoer.net/posts/network/openwrt-ssl