4

Be aware, that local device management (option ‘Control a local device’ on start screen) will only work via port 80 (HTTP) effectively bypassing any encryption. Device passwords are transmitted in clear over the network. You can check this with:

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i any

This is by design, as device discovery is using the device’s IP address for API requests and one will hardly get a commercial certificate for this private IP. Such requests cannot easily translate into valid https requests.

Thus, while the Web interface works fine with e.g. Let’s Encrypt certificates, the app does not. Redirecting http traffic to https in lighttpd breaks the app (‘Response error’) and not redirecting the traffic will reveal passwords in clear on the local network.

To fix this, the app would have to look up the hostname of the router and then use that for the http request. This could then be redirected to https by lighttpd provided the app supports an SSL stack. The router would have to show a valid certificate for the name returned by the lookup.