1

Since it’s quite annoying to get the invalid certificate warning every time I connect to my switch, I want to install a custom HTTPS certificate signed by a Certificate Authority my machines trust. But I can’t figure out Netgear’s ridiculous certificate configuration UI. It only gives the option to upload the following:

  • SSL Trusted Root Certificate PEM File
  • SSL Server Certificate PEM File
  • SSL DH Weak Encryption Parameter PEM File
  • SSL DH Strong Encryption Parameter PEM File

There’s no option to upload a key, or to generate a CSR on the switch (like any sane security system would). The Netgear forums indicate there’s some magic combination of how to do this, but most posts are either incomplete or don’t advise how to get a CA-signed cert to work (only a lone, self-signed key). The official manual is even less helpful, saying nothing more than “[ensure] the file is in the correct format”.

What’s the right way to configure this?

1

First, this should work on any Netgear firmware with a similar UI, but for reference, this is a GS724Tv4 with firmware 6.3.0.9.

I’m going to assume existing knowledge of how to create a root CA, intermediate CA, and create and sign certificates (if not, see e.g. OpenSSL Certificate Authority). We’ll need the following:

  • Root CA certificate (root.cert.pem)
  • Intermediate CA certificate (intermediate.cert.pem)
  • Server certificate with commonname for the switch (switch.cert.pem)
  • Server key corresponding to the server certificate (switch.key.pem)
  • DH 1024-bit params, perhaps 2048-bit would be better (dhparams.pem)

Create two files:

  • The cert chain: cat root.cert.pem intermediate.cert.pem > ca-chain.pem
  • The certificate + key: cat switch.cert.pem switch.key.pem > switch-combined.pem

In the switch’s web UI:

  1. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Disable”, Apply.
  2. Security → Access → HTTPS → Certificate Management → Set “Delete Certificates”, Apply.
  3. Maintenance → Download → HTTP File Download
    1. Select “SSL DH Strong Encryption Parameter PEM File”, and choose dhparams.pem, Apply.
    2. Select “SSL Trusted Root Certificate PEM File”, and choose ca-chain.pem, Apply.
    3. Select “SSL Server Certificate PEM File”, and choose switch-combined.pem, Apply.
  4. Security → Access → HTTPS → Certificate Management → Verify indicates “Certificate Present: Yes”.
  5. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Enable”, Apply.

Now you should have working HTTPS with your CA-signed cert.

0

Do not try to use a 2048 bit DH Strong encryption parameter as it prevented HTTPS Admin Mode from working. The certificate management tab would show that a certificate was present.

However, the GUI interface would give errors about being unable to find some missing functions when attempting to enable HTTPS Admin Mode and while the GUI would show that it was enabled, nothing would listen on the assigned port.

Disabling the HTTPS Admin Mode, deleting the certificates and following the certificate loading sequence above with a 1024-bit DH strong encryption parameter got it to work.

0

I ran into an issue with the ProSAFE M4300 switches that caused Andrew Marshall's steps to not work.

The "Trusted Root" cert should only be the Root CA's cert and not include the intermediary. The "Server cert file" should contain the key, the server's cert, and then any intermediaries (excluding the root). Following the original solution as posted resulted in SSL protocol errors.

All other steps remained the same otherwise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.