5

Since it’s quite annoying to get the invalid certificate warning every time I connect to my switch, I want to install a custom HTTPS certificate signed by a Certificate Authority my machines trust. But I can’t figure out Netgear’s ridiculous certificate configuration UI. It only gives the option to upload the following:

  • SSL Trusted Root Certificate PEM File
  • SSL Server Certificate PEM File
  • SSL DH Weak Encryption Parameter PEM File
  • SSL DH Strong Encryption Parameter PEM File

There’s no option to upload a key, or to generate a CSR on the switch (like any sane security system would). The Netgear forums indicate there’s some magic combination of how to do this, but most posts are either incomplete or don’t advise how to get a CA-signed cert to work (only a lone, self-signed key). The official manual is even less helpful, saying nothing more than “[ensure] the file is in the correct format”.

What’s the right way to configure this?

7 Answers 7

5

First, this should work on any Netgear firmware with a similar UI, but for reference, this is a GS724Tv4 with firmware 6.3.0.9.

I’m going to assume existing knowledge of how to create a root CA, intermediate CA, and create and sign certificates (if not, see e.g. OpenSSL Certificate Authority). We’ll need the following:

  • Root CA certificate (root.cert.pem)
  • Intermediate CA certificate (intermediate.cert.pem)
  • Server certificate with commonname for the switch (switch.cert.pem)
  • Server key corresponding to the server certificate (switch.key.pem)
  • DH 1024-bit params, perhaps 2048-bit would be better (dhparams.pem)

Create two files:

  • The cert chain: cat root.cert.pem intermediate.cert.pem > ca-chain.pem
  • The certificate + key: cat switch.cert.pem switch.key.pem > switch-combined.pem

In the switch’s web UI:

  1. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Disable”, Apply.
  2. Security → Access → HTTPS → Certificate Management → Set “Delete Certificates”, Apply.
  3. Maintenance → Download → HTTP File Download
    1. Select “SSL DH Strong Encryption Parameter PEM File”, and choose dhparams.pem, Apply.
    2. Select “SSL Trusted Root Certificate PEM File”, and choose ca-chain.pem, Apply.
    3. Select “SSL Server Certificate PEM File”, and choose switch-combined.pem, Apply.
  4. Security → Access → HTTPS → Certificate Management → Verify indicates “Certificate Present: Yes”.
  5. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Enable”, Apply.

Now you should have working HTTPS with your CA-signed cert.

3
  • For reference, a self-signed certificate can be installed by uploading just switch-combined.pem and dhparams.pem. The switch-combined.pem file can be used for both the "Trusted Root" and the "Server Certificate" (not sure if both are necessary). My system is a GS108Tv2 with firmware 5.4.2.33. Nov 4, 2019 at 20:11
  • FWIW, this does not work on a GS308T (S350-series) switch. I've tried the above as well as the other answer below. The switch says it takes the certificates and they're present, but upon re-enabling HTTPS access, the switch just generates new self-signed certificates and overwrites my custom ones. I have opened a case w/ Netgear about this, as either there are specific parameters needed for the certificates or there is a bug in the firmware.
    – Kumba
    Apr 20, 2020 at 1:52
  • Can confirm this works on the GS110TP switch too. You are however limited to 2048-bit RSA keys. (Can't use anything bigger.)
    – Adambean
    May 21, 2020 at 9:41
3

Do not try to use a 2048 bit DH Strong encryption parameter as it prevented HTTPS Admin Mode from working. The certificate management tab would show that a certificate was present.

However, the GUI interface would give errors about being unable to find some missing functions when attempting to enable HTTPS Admin Mode and while the GUI would show that it was enabled, nothing would listen on the assigned port.

Disabling the HTTPS Admin Mode, deleting the certificates and following the certificate loading sequence above with a 1024-bit DH strong encryption parameter got it to work.

1
  • On the GS108Tv2 I was also limited to a 1024-bit private key. Nov 4, 2019 at 19:56
1

The GS308Tv1 with firmware 1.0.0.12 is different again.

  • The "SSL Trusted Root Certificate PEM File" should contain the Server Certificate only.

  • The "SSL Server Certificate PEM File" should contain the Intermediate Certificate (optional) followed by the Server Private Key.

If you repeat the Server Certificate in the second file then it will be duplicated in the TLS connection, which is invalid (but still works for self-signed certificates). The Root Certificate should not be uploaded to the switch.

  • The "SSL DH Weak Encryption Parameter PEM File" expects 512 bits.
  • The "SSL DH Strong Encryption Parameter PEM File" expects 1024 bits.

This switch supports TLSv1.2 and will accept a 4096-bit RSA key as well as the SHA512 signature algorithm (it's just running Linux/OpenSSL/Lighttpd).

I recommend using a 2048-bit RSA key (the same as the automatically generated self-signed certificate) because 4096-bit RSA is 3 times slower to connect and may degrade the performance of the switch.

1

For the MS108EUP with firmware 1.0.1.9, the certificate configuration file can be uploaded under Settings > GUI Access > Certificate Configuration > Certificate Update.

It must be a plain-text file with a .pem extension and have the following format:

-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
<snip>
-----END RSA PRIVATE KEY-----

Note that the private key block must be -----{BEGIN/END} RSA PRIVATE KEY-----. -----{BEGIN/END} PRIVATE KEY----- will not be accepted by the switch.

It is not possible to include an intermediate certificate to be served by the switch.

I obtained this information via consultation with Netgear's customer support. Note that the manual for the MS108EUP is out-of-date and includes descriptions that do not match the current firmware.

I am posting here because this answer came up in my searching for how to configure this switch's certificates; I hope it will help the next person to come along.

Below is the example certificate file that was provided to me by Netgear support. It was named ms180eup-new.pem, but the name is not important besides the extension. Please do not use this certificate for your switch, since the private key has been compromised by my posting of it here.

-----BEGIN CERTIFICATE-----
MIIDSjCCAjKgAwIBAgIJAIG23tYYz5/lMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJIVzELMAkGA1UEBwwCT08xCzAJBgNVBAoMAlJSMQsw
CQYDVQQLDAJOVDELMAkGA1UEAwwCTlQwHhcNMjMwNDI2MDIzMDMwWhcNMzMwNDIz
MDIzMDMwWjBOMQswCQYDVQQGEwJVUzELMAkGA1UECAwCSFcxCzAJBgNVBAcMAk9P
MQswCQYDVQQKDAJSUjELMAkGA1UECwwCTlQxCzAJBgNVBAMMAk5UMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6hs0QtBNFacqXIFDFj2b3I2iTO8Q8nx4
v5j11nq3DVfv1nuHB5YSDtHf1yfONH0M9xdMLbQ0pS+qC7RN8uExD8XS4sTOVwoF
vhWMKlWAGRi4NlcSQnB9EZKyVCf7bx8vU/rJsEPbUWjP/8POQqz3t1W5Ly7GZ74T
B3mzS1hX9VIHZdQH4/Ij0Y7cRWZpKyFZ6GAaaAp1KA6fTaOIR7lFpNavL8nO1BgP
OKd+karkByaQ0hqfpzFp32VzGlvQCc9hjAZgCZDX1rH1/8MRPADtr0wa6ceb6MLm
JKfvA3iv9on7AH48vTDJ7M4y8JAXTxBoZCGah3o5BTKnlUv3gpZH8QIDAQABoysw
KTAnBgNVHREEIDAegg13d3cudGVzdDEuY29tgg13d3cudGVzdDIuY29tMA0GCSqG
SIb3DQEBCwUAA4IBAQBqku6P/IeLXSbtJCTVIMEUz55BcOEkXwoafycSH+wN3sph
CjUZa+nZugV6+THFLT+B4sN9UB0vSonJYIy5dchdplZzvrO9mrWwIkKTH9qWCjdJ
4c+bWvRa5crYkwDrN9iPxZaRBvOwlj1LDSMMQRysNkMWI2yczdT1/zCLL7uVubRG
z6Uuvpv2ViAizeR3wQdM+Kmk4/F6WZKzihGDBeODaW3DNvHFAGuNws2xhMn4eUz0
qSjn4c2AFzbUuC48mOVdP1LtdXEdfVeYXKFD7hvXt+xT1vAgPf9tQ+dsBJXosHlU
ux14aBeeXVKoxUKA01i4r0NqErAmIr1EYGBSi60B
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDqGzRC0E0Vpypc
gUMWPZvcjaJM7xDyfHi/mPXWercNV+/We4cHlhIO0d/XJ840fQz3F0wttDSlL6oL
tE3y4TEPxdLixM5XCgW+FYwqVYAZGLg2VxJCcH0RkrJUJ/tvHy9T+smwQ9tRaM//
w85CrPe3VbkvLsZnvhMHebNLWFf1Ugdl1Afj8iPRjtxFZmkrIVnoYBpoCnUoDp9N
o4hHuUWk1q8vyc7UGA84p36RquQHJpDSGp+nMWnfZXMaW9AJz2GMBmAJkNfWsfX/
wxE8AO2vTBrpx5vowuYkp+8DeK/2ifsAfjy9MMnszjLwkBdPEGhkIZqHejkFMqeV
S/eClkfxAgMBAAECggEBAJgwuUfaPNKfywU6L0/NG39FQEa9gAnz61e7a85UFp6B
FXUc9wpygCjMPbWUthQfW4diyO5JYZQlqWlUfPwxc4CqfU9Y3D9vT45kWavHy7AF
BvSkpEU29cev02isWWPDJTR2LBn/8xs4hUfjljp4Uc4I14uZ3/ffdGV+s5V+yCe9
Pqaz+lMeWhHHSl5TkiXJuhXgmaqzOCuairnppTpYJ2bXzgIxHWVlIZPUSW1GbqlU
A+86H9TOgpd76IGwl3SKQLLBGaD+gKKY9bCS6QiceJVjjQcxgDUl2HLgYUeMbaYK
bZV3r1PmL8AXydcLO9cQu6hOV5u+yKndF7zB8Gf3jgECgYEA+FX0ux4ICHtZTDmS
D76MdwBGvlLQapeBYwQlOoRCLysSdva7ASen2HaZxMkICGXdNoNiIM/wj2F5CjgO
n1bSLNGzBu5lTHUfzhz1yqYAJNwOSXSGcmd9Fbyj2YQ9Py7fgz4YPyKlzbzTP8gP
fFP5pUxIku4jfWlN0/Uwru0/nWECgYEA8VTS+1900nf50s4UH2VocN07MoTf8Rtf
P8HjHFFxLUEs6nPXDSJeHCI/WZNHpwmWVBS/oJ9AFoZSE6Kb34JQgkmzM8qosIa2
iWK6qcYwjvA27Hl/31LozVTfkXmAbNFBWqjxqerPUWahzKS/3xyKtRMc6QnNDavz
VYKR4D48pJECgYBN8dzApmprDxw2GpPHsU0xRLrvndqgujD4PSLaPQzw9Rn0kPid
Ii9Cd+dHprmIuUA3jgFMvzeIKVXuaS3dwUhynNcOQ+EzoEd9UAWtt3CwIQmy8IoK
eoT+P5lF+oWmwTWSYfkGR/+2lZ/QkyCZK1peEZVt2KT3BghRkNHY9cpTwQKBgA8R
eMrxPt4VV6ft7hu3vTmu1o9k9IadaukUNhYCj8p/k0pgSUEssCuZh9MT+xlW4+gE
E6L3zoyZfm5zbMAb5uL7rxDAyp+bCbKyU21eTpHeNc+2FmHfT2HitsLijz48IpSC
j/RIEQHIIrogX0qTAaYkt11lm0QLRHpGWM1jlW3BAoGBAMSkn17sB+IEsoLlvPEJ
lzq1iVAKurXEHD52beJn1/5VlBihMYq2ZRRZTbB/12KZdGwSe99VRLjDPy/NVuaZ
P+ktlGIxiXar2A1IVAscWd9rtujF6n4yGm5sl/vbevQ0BhZROTKDWSQizc4djg9y
bdLA4qsGap/9qJVfCWHi0+8/
-----END RSA PRIVATE KEY-----
0

I ran into an issue with the ProSAFE M4300 switches that caused Andrew Marshall's steps to not work.

The "Trusted Root" cert should only be the Root CA's cert and not include the intermediary. The "Server cert file" should contain the key, the server's cert, and then any intermediaries (excluding the root). Following the original solution as posted resulted in SSL protocol errors.

All other steps remained the same otherwise.

0

I've messed around with the installation on a GS108Tv2 with firmware version V7.0.9.5. What a nightmare!

The instructions at the top didn't worked for me. But after a lot of try-and-error I finaly got it run!

As described you need the CA, Intermediate (if existing) and the server certificate as well as the key in PEM (Base64) format.

Copy the certificates into a single file. It seems that the order of the certificates is important (top=server, middle=intermediate, bottom=CA)

  • Windows CMD: type Server.pem Intermediate.pem CA.pem > CertChain.pem

Now upload the CertChain.pem as “SSL Trusted Root Certificate PEM File”, and the file with the server certificae key only as “SSL Server Certificate PEM File”. Also upload the DH Parameters based on the RSA key size of the server certificate.

0

As of firmware version 6.3.1.43 on the GS724Tv4, uploading the “SSL DH Strong Encryption Parameter PEM File” no longer seems to be necessary because the switch just generates them automatically. You only need the “SSL Trusted Root Certificate PEM File” and the “SSL Server Certificate PEM File”.

One thing to note, however, is that the certificate's private key must be RSA - it does not work with an EC private key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .