Tailscale status give scary warning "intercepted connection; certificate is self-signed by CN=console.gl-inet.com"

Router VPN, DNS, Leaks
1

hello, thanks, i just setup tailscale my beryl7, then on my laptop, i ran tailscale status

and saw this scary message, what is going on?

Health check:
Tailscale could not establish an encrypted connection with '"derp1i.tailscale.com"': likely intercepted connection; certificate is self-signed by CN=console.gl-inet.com,O=GLiNet,L=Hong Kong,ST=Hong Kong,C=HK”

2

What firmware are you on with said device?

Are you located in China?

Where did you purchase your gl inet device from?

4

Hi,

The warning indicates that Tailscale received a certificate for console.gl-inet.com instead of the expected Tailscale server certificate.

Could you please help check the following information?

  1. Please confirm whether any other VPN-related features are enabled at the same time, such as WireGuard Client, OpenVPN Client, Exit Node, GoodCloud Site-to-Site, or AstroWarp.
  2. When the issue occurs, please run the following command on the device running Tailscale and provide the result:
nslookup derp1i.tailscale.com

This will help us check whether the Tailscale server domain is resolved correctly or whether it is being redirected to the router.
Thank you for your cooperation.

5

hi, thanks,
it is a brand new beryl7, it was running 4.8.x firmware.
i updated it to 4.9.0 and did not save settings during the firmware update.

purchased from amazon.com in the USA

6

hello, thanks,

so, yesterday, i got the message, but today, i cannot reproduce the message.
i will keep testing to see if i can reproduce it again.

brand new beryl7, came with 4.8.x firmware.
the first thing i did was update firmware to 4.9.0 without saving settings.
then i installed tailscale and got that message.

not using any other vpn, never used goodcloud and astrowarp

nslookup derp1i.tailscale.com
Server:  magicdns.localhost-tailscale-daemon
Address:  100.100.100.100

Non-authoritative answer:
Name:    derp1i.tailscale.com
Addresses:  2607:f740:f::e19
          199.38.181.103
7

Hi,

Thank you for your update.

After the router is reset or upgraded without retaining settings, and before the initial Admin Panel setup is completed, the router may temporarily resolve domain requests from connected devices to 192.168.8.1 so that they can be redirected to the Admin Panel.

In this situation, the Tailscale DERP domain may also be temporarily resolved to 192.168.8.1. Tailscale then connects to the router’s local management service and receives the self-signed certificate for console.gl-inet.com, which causes the certificate warning.

After the Admin Panel initialization is completed, the router will no longer redirect domain requests to 192.168.8.1, and the Tailscale server domain should resolve to its actual server IP address.
Your current nslookup result also shows that the Tailscale domain is now resolving to the correct public server IP.

Thank you for your understanding and support.

1 Like
9

thanks for the explanation, so far i cannot reproduce.

before i installed tailscale, i changed to lan to 192.168.62.x