Configuring a custom HTTPS certificate on a Netgear Switch (e.g. GS724T)

Server Fault Asked by Andrew Marshall on January 1, 2022

Since it’s quite annoying to get the invalid certificate warning every time I connect to my switch, I want to install a custom HTTPS certificate signed by a Certificate Authority my machines trust. But I can’t figure out Netgear’s ridiculous certificate configuration UI. It only gives the option to upload the following:

  • SSL Trusted Root Certificate PEM File
  • SSL Server Certificate PEM File
  • SSL DH Weak Encryption Parameter PEM File
  • SSL DH Strong Encryption Parameter PEM File

There’s no option to upload a key, or to generate a CSR on the switch (like any sane security system would). The Netgear forums indicate there’s some magic combination of how to do this, but most posts are either incomplete or don’t advise how to get a CA-signed cert to work (only a lone, self-signed key). The official manual is even less helpful, saying nothing more than “[ensure] the file is in the correct format”.

What’s the right way to configure this?

4 Answers

The GS308Tv1 with firmware is different again.

  • The "SSL Trusted Root Certificate PEM File" should contain the Server Certificate only.

  • The "SSL Server Certificate PEM File" should contain the Intermediate Certificate (optional) followed by the Server Private Key.

If you repeat the Server Certificate in the second file then it will be duplicated in the TLS connection, which is invalid (but still works for self-signed certificates). The Root Certificate should not be uploaded to the switch.

  • The "SSL DH Weak Encryption Parameter PEM File" expects 512 bits.
  • The "SSL DH Strong Encryption Parameter PEM File" expects 1024 bits.

This switch supports TLSv1.2 and will accept a 4096-bit RSA key as well as the SHA512 signature algorithm (it's just running Linux/OpenSSL/Lighttpd).

I recommend using a 2048-bit RSA key (the same as the automatically generated self-signed certificate) because 4096-bit RSA is 3 times slower to connect and may degrade the performance of the switch.

Answered by Simon on January 1, 2022

I ran into an issue with the ProSAFE M4300 switches that caused Andrew Marshall's steps to not work.

The "Trusted Root" cert should only be the Root CA's cert and not include the intermediary. The "Server cert file" should contain the key, the server's cert, and then any intermediaries (excluding the root). Following the original solution as posted resulted in SSL protocol errors.

All other steps remained the same otherwise.

Answered by Bryan Wyatt on January 1, 2022

Do not try to use a 2048 bit DH Strong encryption parameter as it prevented HTTPS Admin Mode from working. The certificate management tab would show that a certificate was present.

However, the GUI interface would give errors about being unable to find some missing functions when attempting to enable HTTPS Admin Mode and while the GUI would show that it was enabled, nothing would listen on the assigned port.

Disabling the HTTPS Admin Mode, deleting the certificates and following the certificate loading sequence above with a 1024-bit DH strong encryption parameter got it to work.

Answered by Woodogre on January 1, 2022

First, this should work on any Netgear firmware with a similar UI, but for reference, this is a GS724Tv4 with firmware

I’m going to assume existing knowledge of how to create a root CA, intermediate CA, and create and sign certificates (if not, see e.g. OpenSSL Certificate Authority). We’ll need the following:

  • Root CA certificate (root.cert.pem)
  • Intermediate CA certificate (intermediate.cert.pem)
  • Server certificate with commonname for the switch (switch.cert.pem)
  • Server key corresponding to the server certificate (switch.key.pem)
  • DH 1024-bit params, perhaps 2048-bit would be better (dhparams.pem)

Create two files:

  • The cert chain: cat root.cert.pem intermediate.cert.pem > ca-chain.pem
  • The certificate + key: cat switch.cert.pem switch.key.pem > switch-combined.pem

In the switch’s web UI:

  1. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Disable”, Apply.
  2. Security → Access → HTTPS → Certificate Management → Set “Delete Certificates”, Apply.
  3. Maintenance → Download → HTTP File Download
    1. Select “SSL DH Strong Encryption Parameter PEM File”, and choose dhparams.pem, Apply.
    2. Select “SSL Trusted Root Certificate PEM File”, and choose ca-chain.pem, Apply.
    3. Select “SSL Server Certificate PEM File”, and choose switch-combined.pem, Apply.
  4. Security → Access → HTTPS → Certificate Management → Verify indicates “Certificate Present: Yes”.
  5. Security → Access → HTTPS → HTTPS Configuration → Set “HTTPS Admin Mode” to “Enable”, Apply.

Now you should have working HTTPS with your CA-signed cert.

Answered by Andrew Marshall on January 1, 2022

Add your own answers!

Ask a Question

Get help from others!

© 2024 All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP