Should i replace my od APs which do not have ability to replace /
regen SSL certs?
reddit / selfhosted

----------------------------------------------------------------------
domanpanda · 2023-11-05 10:36

I have Edgerouter EX as my (nomen omen) egde router and DHCP device. I
dont worry about it. But i also use Netis WF2780 and TPlink Archer C6
V2 as AP's. Following "zero trust" practice i covered most of my
devices with SSL -> nginx proxy with LE cert for clients and ssl
verification for upstream devices. Upstream devices have leaf certs
signed by my CA cert (which proxy uses for verification.

Now TPLink has self generated cert which i cant replace and Netis does
not even use HTTPS at all (and it cant be enabled).

So should consider replacing them with something better? Something
which would allow me to upload my won certs?

----------------------------------------------------------------------
vrgpy · 2023-11-05 17:37

Think before what is your treat scenario that you need encryption on
your internal network?

----------------------------------------------------------------------
domanpanda · 2023-11-05 18:25

Some time ago friend's network has been hacked. I don't know the
details but there's highly change that one of his kids clicked at
nasty link or downloaded something they shouldn't.
My kid is 8yr, my network contains things like vaultwarden, nas with
important documents etc. Call me paranoic but i just sleep better when
my network is split and i have encrypted traffic.

----------------------------------------------------------------------
vrgpy · 2023-11-05 18:33

Encryption won't help you there.

You should isolate all the admin interfaces in a different vlan or at
least only accessible from your trusted IPs.

You could also allow access only from a VPN.

If your kids download some Trojanend app, they can try to brute force
into your admin interfaces, encrypted or not. Also, some web
interfaces are not safe enough to stay accessible to malicious actors.

----------------------------------------------------------------------
domanpanda · 2023-11-05 20:40

Isolation is already done. As i said kid's devices are on separate
network (i made a split). Intruder wont access any devices on my main
network. Yet i think i should use HTTPS on all my devices too. Am i
too paranoic?

----------------------------------------------------------------------
vrgpy · 2023-11-05 21:13

Encryption does help to avoid a party to capture users/passwords in
transit to your devices.

As long as your local public network is never used to access admin
interfaces, that problem is mostly mitigated.

it can't hurt, but I think the incremental security gain is not much.

----------------------------------------------------------------------
kmisterk · 2023-11-06 18:38

## Post Removed

Hey, domanpanda!

Thanks for your submission on selfhosted.

Your post has been removed due to a violation of the purpose of the
subreddit: **Self Hosting**

## Not Self-Hosted

When it comes to posts regarding applications in this subreddit, they
must feature a self-hosted tool, or a tool that *can be* self-hosted,
or some kind of related information, help request, or otherwise
related to a tool that is something that one can self-host.

If you believe this post *is in fact* relevant to /r/selfhosted, feel
free to [message the mods](https://www.reddit.com/message/compose/?to=
/r/selfhosted&subject=Removed For Not Being Self-
Hosted&message=[Removed
Post](https://www.reddit.com/r/selfhosted/comments/17o96rf/-/\)) with
your concerns.