Source
r/HomeNetworking•
echoAnother

Getting ssl certificate of router instead of server

TL;DR: I'm getting sporadically the router ssl cert, when requesting a service hosted behind the router. And I'm asking how it's possible, and why it can happen.

I have a service (seafile), behind an apache reverse proxy in a server.

The client resides within the local network, and presumably connects to https://seafile.mydomain.tld. This is the third time a client shows an ssl error message, complaining about the cert not being of trust "The computer name did not match any of the valid computers for this certificate". First time 2 internal clients complained at the same time, this time only complained one.

I checked, and is the certificate of my router. It happens during a time frame very short. I immediately restart the client, or check the cert on the browser and is the server one.

Right now, I'm questioning all my knowledge of networks. How it's possible to get the router cert instead of the server?

I took a look on the scarce log of the router. And nothing is strange.

I thought of conflicts with forwarding rules, but there is only rules for this server on 80 and 443 ports, dmz disabled, and all services provided by the router are disabled, except for internal web interface.

My instincts tell me that is the router miss-translating. But I don't know what to search for.

Posted Dec 16, 2020, 3:55 AM UTC

16
7yearlurkernowposter•

Is your router a combination box with your modem? Sometimes ISPs will force people through a portal this way to accept the ToS.
Can you share the hostnames the cert is claiming?

1
echoAnotherOP•

It's a router-modem, but it's not the ISP router, and only acts as router. It's in bridge mode to the ISP router. It's a tplink Archer C5 V4.

Basically tplinkwifi.net and my_public_ip

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ***
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=TP-LINK SOHO Router CA, O=Archer C5, OU=68FF7BCE5E11A5BEEC4CAE0CDA035DF3B600
        Validity
            Not Before: Jan  1 00:00:00 1970 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: CN=tplinkwifi.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    ***
                Exponent: ***
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                ***
            X509v3 Authority Key Identifier: 
                keyid:***
            X509v3 Subject Alternative Name: 
                DNS:tplinkwifi.net, DNS:84.127.88.30, IP Address:84.127.88.30, DNS:192.168.0.1, IP Address:192.168.0.1
    Signature Algorithm: sha256WithRSAEncryption
         ***

-----BEGIN CERTIFICATE-----
***
-----END CERTIFICATE-----
1
7yearlurkernowposter•

This is very strange, I've seen this happen with AV tools that want to do cert substitution attacks to scan TLS connections but including that on a router seems unheard of and dangerous.
I would lean more towards the router is behaving improperly through some sort of bug. Do you see any options in the menu for something like ssl offload / broker / proxy that you can disable?

2
echoAnotherOP•

Nothing about ssl offload, broker or proxy.

1
djeremaille•

Hi,

I have the same problem since yesterday.

My modem/router is the ISP one. It's a Livebox by Orange (France).

1
djeremaille•

Ok. For me it's due to a faulty update of my box. I had to change https port to another one.
https://communaute.orange.fr/t5/Livebox-5/Suite-au-changement-de-firmware-2-5-10-cette-nuit-la-fonction/m-p/2390162/highlight/true#M9734

1