How to install https certificate on GDS3705/10?

#1

Hi,

Trying to install certificates, I first followed this guide, but only getting the “invalid certificate” error:
https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/

I have read on this forum that for other devices from Grandstream, the following free certificate service was recommended:
https://letsencrypt.org/getting-started/
But I quickly ran into trouble: although we have shell access on the GDS3710, we cannot install the Certbot client as explained in the guide, can we ?

Does any guide exist that actually applies to the GDS3705/10 ?

#2

@deedee: Are you referring to customized certificate? You have to generate legal certificate someway from somewhere, then upload into GDS via the web UI.

Hope this helps. Thank you for using Grandstream Access Control products.

#3

@GS_Guy: you are correct, I am indeed referring to custom certificates. I get that you need to generate them in someway, I just need to understand the specifics.

For instance, according to the let’s encrypt guide mentioned above: as GS doesn’t seem to support certbot installation, nor offers support for built-in let’s encrypt, I suppose that the only way to go is “manual mode”. Correct ?

I then need to choose between http and DNS challenge. It seems I have to choose DNS ? But then this:

When using the dns challenge, certbot will ask you to place a TXT DNS record with specific contents under the domain name consisting of the hostname for which you want a certificate issued, prepended by _acme-challenge .

Where do I place this file, as I am directly connecting to the GDS by its IP address ?

#4

@deedee I am not good at network security and etc., I guess you might google “how to generate a certificate” and see whether you can get some hints. Or you can open a support ticket at Grandstream HELPDESK to ask related engineer to help you.

For the GDS, if you already have a legal and valid certificate file, just log into the device and upload into the internal cache memory of the GDS, the certificate file will be stored inside the device for related usage.

image
image.png1311x718 30.5 KB

Hope this helps. Thank you very much!

#5

If you intend tu use let’s encrypt kind of certificates, then, you will need an additional piece of hardware (not the GDS) to implement what is required for the mechanism of let’s encrypt to work. It could be a raspberry pi running linux or something else. The GDS is not meant to offer that kind of service. Which is, IMHO, quite normal…

#6

@golfvert, thanks for chiming in.

Above all, I intend to establish a safe connection to the GDS 3710. I still couldn’t figure out how to do it. Is there a way to achieve that without additional hardware (as per your suggestion) ?

#7

You want to HTTP_S_ to your GDS? So that the trafic is encrypted and nothing else?
I can think of few options;

  1. create self signed certificates on your PC with “openssl” and upload those certificates on the GDS. Your browser, when accessing the GDS may/will complain that the certificate is not valid but, you should be able to bypass this warning.
  2. don’t bother with certificates. Enable HTTPS on the GDS. Your browser WILL complain about that. It should nevertheless allow to bypass the warning.
  3. Do it the “clean” way. Buy a certificate somewhere (eg cloudflare) and with the correct DNS configuration you should be able to connect to your GDS (after having uploaded the certs) without issues

It really depends on your use case. 1. and 2. are crapy solutions but might be sufficient depending on why you want that.
IMHO, if your network is not safe enough to use HTTP it is probably not safe enough to use “dirty” HTTPS.

#8

Yes, I want to avoid a potential MIM attack (the GDS is accessible from the internet). I thought using the certificates was just good practice, and hence there would be documentation.

Regarding 1., I tried that (first guide I mentioned), to no avail.
2. is how I’m using it right now. Doesn’t feel quite right, though.
I was hoping to do 3. with letsencrypt…

#9

do you have to expose it to the whole world? can’t you enable NAT in ACL?

#10

I think that creating/managing certs is out of scope of a videophone.
Using let’encrypt require a piece of hardware on the side.
Nothing to be done here, I am afraid…