Security

I want to apply https to my Shelly devices.  To do this, you need a CA certificate.

How to create?

• Open a Linux terminal on e.g. a Raspberry Pi

• Make sure openssl is installed

• Create a CA key:
  openssl genrsa -out ca.key 2048
  This will generate a ca.key file.

• Create a root certificate (in this example, for 10 years):
  openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
  You will be asked for the following data (fake data given...):

  • Country Name (2 letter code): BE

  • State or Province Name (full name): Wild-Walloon

  • Locality Name (city): Bevergem

  • Organization Name (eg, company): Chop Choi Pty Ltd

  • Organizational Unit Name (eg, section): Breakdown Section

  • Common Name (eg server FQDN or YOUR name): 568.244.214.023 (should be the IP address of the device, preferrably)

  • Email Address: chop.choi@johndoe.moc

This will generate a ca.crt file (crt stands for certificate).

• Create a private key for the Shelly device:
  openssl genrsa -out shelly.key 2048
  This will create a shelly.key file.

• Create a Certificate Signing Request (CSR)  for the Shelly device:
  openssl req -new -key shelly.key -out shelly.csr
  You will again be asked for the same data as given above.  Fill in the same values.
  You will also see a request for some extra data:

  • A challenge password

  • An optional company name

I didn't fill in anything for those two items, they're not mandatory.
This will create a shelly.csr file.

• Sign the Shelly certificate with the local CA certificate (in this example, also for 10 years):
  openssl x509 -req -in shelly.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out shelly.crt -days 365 -sha256
  This will create a shelly.crt file, signed by our own local CA certificate.

To trust the certification on the computer (browser) you have to install it on the computer. 

To install it on a Windows computer do the following:

• Copy the file ca.crt from the Linux machine to the Windows machine

• Double-click on the file and follow the prompts to install it on the Windows machine

  • In the popup box, click Install Certificate...

  • Select Local Machine and press Next, confirm UAC authority

  • In the next screen, select "Place all certificate in the following store" and press the Browse button

  • In the next popup screen, select "Trused Root Certification Authorities" and press OK: the name will be filled in into the Certificate store input field in the previous window.
    Press Next

  • In the final screen, press Finish to end the certification installation process

• Once the certificate is installed, close the popup window and double-click again on the original ca.crt file.  This time, you won't see the warning anymore that this is not a trusted certificate since you installed it as a trusted certificate.