# Any way to get a proper certificate instead of a self-signed one on GL-AX1800 (Flint)? **URL:** \ **Category:** Router\ **Created:** [July 31, 2023, 3:55pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956 "2023-07-31T15:55:44Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![SpearmanKinship](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@SpearmanKinship](https://forum.gl-inet.com/u/SpearmanKinship)\ **Post date:** [July 31, 2023, 3:55pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/1 "2023-07-31T15:55:44Z")
I just got this router and I was quite surprised and disappointed to find a self-signed certificate in this router. Is there any way to get a proper certificate instead of a self-signed one on the GL-AX1800 (Flint) running the 4.2.0 firmware? ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [July 31, 2023, 7:07pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/2 "2023-07-31T19:07:56Z")
First, f/w 4.2.3-release5 is the latest for the Flint. Consider upgrading (GL GUI → System → Upgrade). More to the point, technically, yes noting: - Certificates expire usually just at the 1 year mark for a commercially sourced one. - LetsEncrypt is free. - You’ll need a domain name to assign to your Flint as a host. - There’s many free dynamic DNS providers (DynDNS/DDNS) available. I haven’t set this up yet myself but you’ll need deSEC DDNS, LuCI, SSH access to install python3 to configure this particular solution: > **[GitHub - desec-io/certbot-dns-desec: Let's Encrypt Certificates for Domains...](https://github.com/desec-io/certbot-dns-desec)** > > Let's Encrypt Certificates for Domains Hosted at deSEC - GitHub - desec-io/certbot-dns-desec: Let's Encrypt Certificates for Domains Hosted at deSEC > **[How It Works - Let's Encrypt](https://letsencrypt.org/how-it-works/)** > > The objective of Let’s Encrypt and the ACME protocol is to make it possible to set up an HTTPS server and have it automatically obtain a browser-trusted certificate, without any human intervention. This is accomplished by running a certificate... ---
**Author:** ![SpearmanKinship](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@SpearmanKinship](https://forum.gl-inet.com/u/SpearmanKinship)\ **Post date:** [July 31, 2023, 7:56pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/3 "2023-07-31T19:56:08Z")
> First, f/w 4.2.3-release5 is the latest for the Flint. Consider upgrading (GL GUI → System → Upgrade). Does that update add a **proper** certificate to the Flint? I haven’t updated because I like to see how devices perform with the stock firmware before updating. I know of let’s encrypt but this post was meant for a proper certificate from glinet itself, is there a way to get one? Why doesn’t this router come with a valid proper, non self-signed certificate? ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [July 31, 2023, 8:13pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/4 "2023-07-31T20:13:28Z")
> [@SpearmanKinship](#): > > Why doesn’t this router come with a valid proper, non self-signed certificate? > [@bring.fringe18](#): > > Certificates expire usually just at the 1 year mark for a commercially sourced one. > [@bring.fringe18](#): > > You’ll need a domain name to assign to your Flint as a host. … & said domain names for assigning certs are tied to host’s IP. > [@SpearmanKinship](#): > > I haven’t updated because I like to see how devices perform with the stock firmware before updating. 4.2.3-release5 is the new stock/stable build. You can always downgrade if something breaks (GL GUI → System → Upgrade → Local Upgrade). Future builds are going to be based on OpenWrt Linux 22.03 v the current builds of 21.02. It’s your call, of course. ---
**Author:** ![SpearmanKinship](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@SpearmanKinship](https://forum.gl-inet.com/u/SpearmanKinship)\ **Post date:** [August 1, 2023, 2:34pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/5 "2023-08-01T14:34:07Z")
> Certificates expire usually just at the 1 year mark for a commercially sourced one. I never had this issue with any of the router brands I’ve had before this one so not sure how that explains anything. From my standpoint it’s a very big oversight for a network equipment company. ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [August 2, 2023, 3:39am UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/6 "2023-08-02T03:39:33Z")
Go to any TLS enabled site/service of your choice & lookup the Validity Period. ---
**Author:** ![SpearmanKinship](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@SpearmanKinship](https://forum.gl-inet.com/u/SpearmanKinship)\ **Post date:** [August 2, 2023, 12:05pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/7 "2023-08-02T12:05:04Z")
Don’t be dishonest. Certificates have validity periods and no one is questioning that but I never had an invalid or SELF-SIGNED certificate when I visited the admin page of any other router I’ve owned. ---
**Author:** ![groentjuh](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/f17d59/32.png) [@groentjuh](https://forum.gl-inet.com/u/groentjuh)\ **Post date:** [August 2, 2023, 1:32pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/8 "2023-08-02T13:32:41Z")
I really wonder what gear you have had, because I see the following: - ISP provided router: **NO SSL AT ALL!** - HP gear: Self-signed - Zyxel gear: Self-signed ---
**Author:** ![SpearmanKinship](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@SpearmanKinship](https://forum.gl-inet.com/u/SpearmanKinship)\ **Post date:** [August 2, 2023, 2:49pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/9 "2023-08-02T14:49:15Z")
I’m not counting ISP’s routers. Personally linksys (the classic _WRT54G_ on which I even installed openwrt way back in the day), tp-link and medialink. Never had issues with certificates with them. ---
**Author:** ![groentjuh](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/f17d59/32.png) [@groentjuh](https://forum.gl-inet.com/u/groentjuh)\ **Post date:** [August 2, 2023, 3:06pm UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/10 "2023-08-02T15:06:19Z")
Very likely those routers did not even have TLS/SSL on their web-interfaces at all. Yeay for sending the credentials to access your router plaintext to it. OpenWRT recently (since 22.x) does by default do TLS/SSL with self-signed certificates. They rather have TLS/SSL with self-signed certificates protecting them then plaintext communication. ---
**Author:** ![dma](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/f1d935/32.png) [@dma](https://forum.gl-inet.com/u/dma)\ **Post date:** [August 28, 2024, 1:40am UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/11 "2024-08-28T01:40:10Z")
There's no easy way to provision a certificate that actually works without also doing some DNS work. Nobody is going to issue a certificate for `https://192.168.0.1/`. What I was going to do is use [LetsEncrypt DNS-01 challenge](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) to generate the certificate plus a [free HE.net subdomain](https://dns.he.net/) so I can create a `_acme-challenge.axt1800.pvt.mynetwork.org` TXT record and a `axt1800.pvt.mynetwork.org` A record. That way, I could then go to `https://axt1800.pvt.mynetwork.org/` from any device without any warnings. I'd just need something to actually create the certificate on the device. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [August 28, 2024, 5:09am UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/12 "2024-08-28T05:09:14Z")
This [[Script] Let's encrypt for GL.iNet router HTTPs access](https://forum.gl-inet.com/t/script-lets-encrypt-for-gl-inet-router-https-access/41991) should work. ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 11:41am UTC](https://forum.gl-inet.com/t/any-way-to-get-a-proper-certificate-instead-of-a-self-signed-one-on-gl-ax1800-flint/31956/13 "2025-10-29T11:41:11Z")