I recently had to replace my router and got fed up with the SSL certificate warnings (from the self-issued/self-signed certificates) I received when I visited the HTTPS interface while I was configuring it. I also got fed up with constantly dismissing the RDP security warning every time I connected to my Windows servers. I decided to secure my TomatoUSB router administration page with a properly issued/trusted SSL certificate, and secure my RDP connections as well.
(Note: If your workstation(s) are a member of the domain that the server(s) are on, the locally self-issued certificates should already be trusted. I have a few boxes that are not a member of an Active Directory domain, that I wanted to secure.)
Assuming you're Class 2 verified, you can generate a certificate on startssl.com for no additional fee. They will issue certificates for any domains you own, with as many SANs as you need.
You can generate your private key locally, or just use the in-browser generation. Ensure the SAN references your remote DNS address (i.e. server.domain.com as well as domain.com) you plan to access your server(s) with.
- Save your.key file
- Save your.crt file
- Save intermediate CA cert/pem (Class 2, likely). You can find this in Control Panel, Startcom CA Certificates.
- Embed the CA cert into yours
cat Class2CAcert.crt >> your.crt
(i.e. this will overwrite your.crt) - Store these. The private key is still encrypted with the password, but be careful with it, and back it up.
Install the certificate onto your TomatoUSB router to secure the remote administration interface [1]. Ensure HTTPS is already enabled and that it's saved in NVRAM. (If you ever click "regenerate" on the admin page and click save, you'll need to do this again.)
- SSH into the router
- Transfer your.key and your.crt, and decrypt the your.key file.
openssl rsa -in your.key -out your.key
(your.key is now decrypted -- destroy this file after use.) - Replace "/etc/cert.pem" and "/etc/key.pem" files by your own cert files (your.crt and your.key, respectively)
mv your.crt /etc/cert.pem
mv your.key /etc/key.pem - Tar up the keys and commit to nvram
tar -C / -czf /tmp/cert.tgz etc/cert.pem etc/key.pem
nvram setfb64 https_crt_file /tmp/cert.tgz
nvram commit - Restart the httpd service so the new keys are used
service httpd restart
(You may need to close your browser and reopen it; simply refreshing may cause it to use some cached, non HTTPS resources, resulting in a security warning.) - Restart the router and confirm things are working when you access the admin interface, and hopefully flush out the decrypted private key from memory =).
Import the private key to your Windows machine.
- You'll need openssl to convert the .pem files to a .pfx for Windows. Your tomato router may be a reasonable place to do this if you don't have a reasonably secure machine with openssl installed.
openssl pkcs12 -export -out your.pfx -inkey your.key -in your.crt -certfile Class2CAcert.crt - Secure the pfx with a strong password.
- Transfer the pfx to your Windows machine.
- Open mmc.exe, File, Add/Remove Snap-in, add Certificates, pick Computer Account, Local computer
- Go into the Personal store, right click, All Tasks, Import
- Feed it the pfx file, type in the password, and the certificate and private key will be imported. Ideally, DO NOT allow the private key to be exported.
- Delete the pfx file locally.
Now, get your Windows box to use this certificate to secure RDP communications [2]:
- Double click on the public/private-keys we imported above via the pfx. Select the Details tab.
- Scroll down to the Thumbprint field and copy the space delimited hex string, and remove all the spaces from the string.
- Double check the first character of the string -- sometimes, a non-visible character is included there. Trim it out.
- In a Command prompt, set the RDP listener to use the thumbrint/hash: (replace THUMBPRINT with the value you got from the certificate)
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
You can also accompllish this via PowerShell, which I've never tried:
$path = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $path -argument @{SSLCertificateSHA1Hash="THUMBPRINT"}
Securing your connections with a properly issued certificate is ideal, particularly if you access these resources on public connections (WiFi hotspots, etc.) as it ensures you're communicating securely with only the device you intend to.
(Additional) Resources, further reading, etc.:
[1] TomatoUSB - use SSL certificates for WAN admin
http://tomatousb.org/tut:use-ssl-certificate-for-wan-admin
[2] Serverfault - Configure custom SSL certificate for RDP on Windows Server 2012
http://serverfault.com/questions/444286/configure-custom-ssl-certificate-for-rdp-on-windows-server-2012-in-remote-admini