https://192.168.1.1/ shows NET::ERR_CERT_AUTHORITY_INVALID

ilcatal · 2023-04-10T18:45:44+00:00

Sunrise Community - Kunden helfen anderen Kunden rund um die Themen Fernsehen, Internet, Telefon und Mobile. Jetzt registrieren!

ilcatal

Recently (maybe since the last upgrade at 2023/04/10 [after which i again had to restart it manually]) when i try to connect to my “Sunrise Internet Box Fiber Zyxel” modem Web Configurator at https://192.168.1.1/ browsers complain about NET::ERR_CERT_AUTHORITY_INVALID and the connection falls back to http.

Is this intended? Is there a way to have an actual https connection to the modems Web Configurator?

Or am i supposed to install the certificate on each device manually? If yes, is there a way to check its validity first?

Here’s the encrypted certificate:

---–BEGIN CERTIFICATE—–
MIIDhDCCAmygAwIBAgIUIdPbBOPc4t6523lc9RDQPAW1+OMwDQYJKoZIhvcNAQEN
BQAwUzELMAkGA1UEBhMCVFcxDDAKBgNVBAgMA1RXTjEOMAwGA1UECgwFWnlYRUwx
EjAQBgNVBAsMCVp5WEVMY2VydDESMBAGA1UEAwwJWnlYRUxjZXJ0MB4XDTE1MDEw
MTEyMDAwMFoXDTM1MDEwMTEyMDAwMFowUzELMAkGA1UEBhMCVFcxDDAKBgNVBAgM
A1RXTjEOMAwGA1UECgwFWnlYRUwxEjAQBgNVBAsMCVp5WEVMY2VydDESMBAGA1UE
AwwJWnlYRUxjZXJ0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1JRy
juk0tOU780epQIB42Nn+bXMOdwiVM288UZIljNNcvnpyoqF3PGPqSkFUcaSTFzR1
9kBM5/qJr8iapdXUnE2hH8gtcoykyCPiEto6R26v5ILdmRT68msgO3vmURg46a6k
TBm9MkIhsF7OT4B2S5snm89idkckHnJUaxakJ7HGyi8cptCohWCJ+HLJKG5AZAKF
IgSTki+OSOjy1XN0FUvTMTISYcYvV27T1CM6zzu2ZyIHLcmwsFp43X3D4banoduD
KGOlfh8F1Lf/1bHtEeP3D+DFTojmBNhVw6/x2Dhk0yE3qnVDrl2o2mfFexJWE3oT
urpHPK4hwJX16rZZHQIDAQABo1AwTjAdBgNVHQ4EFgQUDNE4Swj0rrMTqCcujTcK
nSWm+78wHwYDVR0jBBgwFoAUDNE4Swj0rrMTqCcujTcKnSWm+78wDAYDVR0TBAUw
AwEB/zANBgkqhkiG9w0BAQ0FAAOCAQEAJsNqQX1Hw1TIAg9lBy/dQtjRVmnWe+dk
UoL/IeQAYXJrptXhBge18/pjaZN7uIz/7b2H1Uvxsa25R0kqgPibLYLZS3M4HdGh
EEzTYm3UA+FaW3DFI9XHvcFWr5pLo6gC2YPIRBcmA70NbT0ru1U70vHokZEk4qaB
hRZzr9AIKnoEPm7Z2ZgDgwIBmGwBIDkIBgB+gzVPapnE39CIpkBIgNTqSRTw0gw6
8Ba8G5Fb81UxJJtOmwF6nISWs8ukVo8rnbRYT+nvRXDgz3u2TIrftnnDG/QmUAIq
fkxp2zoAyOBPlOB3k6YqnObe8LcLNUU/N9pQJUpU433WgFOiRounUg==
---–END CERTIFICATE—–

Here’s what’s in it:

`Common Name:``ZyXELcert`

`Subject Alternative Names:`

`Organization:``ZyXEL`

`Organization Unit:``ZyXELcert`

`Locality:`

`State:``TWN`

`Country:``TW`

`Valid From:``January 1, 2015`

`Valid To:``January 1, 2035`

`Issuer:``ZyXELcert, ZyXEL`

`Key Size:``2048 bit`

`Serial Number:``21d3db04e3dce2deb9db795cf510d03c05b5f8e3`

Here’s the link to the manual:

https://www.sunrise.ch/en/support/internet/other-modems

https://a.storyblok.com/f/113473/x/3da6e2d5f6/user_manual_sunrise_internet_box_fiber_zyxel_en.pdf

pato

I don’t have your device, but this message is normal for devices that you access through an IP address.
You should not get redirected to http though, can you check if this also happens in a second browser?

ilcatal

Ok, sorry, my fault. Chrome only displays it as a stroke through https but it’s still https.

Do i have to install the certificate on each device manually or is there a simpler way?

Is there a way to check its validity?

pato

ilcatal Not really and no. In this case you can just ignore it.

ilcatal

Would be helpful though for Zyxel or Sunrise to provide the certificate so anyone can check it just to be really sure. I searched the net but couldn’t find anything. Is this normal? How can i make sure that this device isn’t already compromised?

pato

ilcatal Essentially you can’t. Also the certificate is custom per device and typically will be created on first bootup. But thanks to locked firmware, it can’t easily be compromised.
You could save and trust this certificate in your browser, but there is a good chance that it changes on a yearly basis.

In the case of the Connect Box 3, at least in Bridge Mode, it doesn’t even offer https, so no “issue” there 😃