Skip to main content

HTTPS & Certificates

The HTTPS & Certificates section allows administrators to configure secure access to the Admin Panel and Captive Portal. It supports preloaded certificates, device-signed certificates, and custom SSL certificates for production deployments.

image.png

HTTPS Modes

The gateway supports multiple HTTPS operation modes depending on security requirements and deployment type.

image.png


Available HTTPS Modes

Preloaded (portal.w-router.com)
Uses a preloaded certificate for the default portal domain portal.w-router.com.
This mode requires no additional configuration and is suitable for quick deployments.

Device-Signed (browser warning)
Uses a self-signed certificate generated by the device.
Browsers will display a security warning. Recommended for testing only.

Custom Certificate (recommended)
Allows uploading a custom SSL certificate for a user-owned domain.
This is the recommended mode for production environments.

HTTP Only (not recommended)
Disables HTTPS entirely. All traffic is unencrypted and may be intercepted.

⚠️ HTTP mode is not recommended and requires explicit acknowledgment.





Current Status Information

The status section displays the active HTTPS state and certificate details.


image.png

Displayed information includes:

  • Current Status – HTTPS, HTTP, or Error state

  • Certificate Type – Preloaded, Custom, Device-Signed, or None

  • Certificate Expiration – Expiry date of the active certificate

Note: Expired custom certificates automatically fall back to a device-signed certificate on reboot.



Uploading a Custom SSL Certificate

Custom certificates allow the use of a branded domain for the Captive Portal and Admin Panel. The HTTPS certificate must match the Captive Portal domain currently configured on the system. If the certificate hostname and portal domain do not match, browsers may display security warnings or block access.

You can change the Captive Portal domain from Captive Portal > Landing Page > Advanced

image.png

Requirements

To successfully install a custom certificate, the following files are required:

  • Certificate file (full chain) – Must include:

    • Domain (leaf) certificate

    • Intermediate CA certificate(s)

  • Private key file – Must match the certificate

⚠️ Uploading only the domain certificate without the intermediate CA will cause HTTPS errors.

Creating a Full Chain Certificate File

Most certificate providers supply multiple files. These must be combined before upload.

Example Files Provided by a Certificate Authority

  • yourdomain.crt (domain certificate)

  • yourdomain.ca-bundle (intermediate certificate)

Combine into a Full Chain File
Create a new file called fullchain.crt with the following order:
yourdomain.crt yourdomain.ca-bundle
Do not include root CA certificates.

1. On Windows (PowerShell):
Get-Content yourdomain.crt, yourdomain.ca-bundle | Set-Content fullchain.crt

2. On Linux / macOS:
cat yourdomain.crt yourdomain.ca-bundle > fullchain.crt

3. Manual Method
You can create the full chain certificate manually using a text edit (eg. Notepad).

Step 1: Open your certificate files

  1. Open yourdomain.crt with Notepad.

  2. Select all content and copy it.

  3. Open yourdomain.ca-bundle with Notepad.

  4. Select all content and copy it.

Step 2: Create the full chain file

  1. Open Notepad.

  2. Paste the contents of yourdomain.crt first.

  3. On a new line, paste the contents of yourdomain.ca-bundle after it.

The order must be:
yourdomain.crt yourdomain.ca-bundle


Upload Steps:

  1. Select Custom Certificate mode.

  2. Upload:

    • Certificate: fullchain.crt

    • Private Key: your .key file

  3. Click Upload.

  4. Click Save to apply the configuration.

image.png

The system validates:

  • Certificate format

  • Certificate and key matching

  • Certificate expiration

Once applied, HTTPS will activate automatically.

HTTP Mode

When selecting HTTP Only, the system displays a warning.

image.png

To proceed:

  1. Check "I understand the risks of using HTTP".

  2. Click Save.

⚠️ In HTTP mode:

  • Traffic is unencrypted

  • Authentication data may be exposed

  • User Data based login methods are automatically disabled

Important Notes

  • Always use a full chain certificate for custom domains.

  • Certificates must match the configured hostname.  

  • Avoid uploading root CA certificates.

  • Monitor certificate expiration dates to avoid service disruption.

  • For production use, Custom Certificate mode is strongly recommended.

 

Back to top