0

First I'll disclose that I'm not a professional in networking by any means. That being said, I manage my family's home/small businness network. We have a few buildings, with the modem being in the middle one. The routers in the other buildings are connected to the modem with point-to-point wifi antennas (TP-Link CP210).

The problem is that I can't access the NOS of the antennas anymore. I get ERR_SSL_VERSION_OR_CIPHER_MISMATCH when trying to connect to the gateway IP. I believed it to be an old version of TLS causing this. None of the major web browsers support older versions of TLS anymore, even trough devtools, and enabling TLS 1.0 and 1.1 in Windows' network setting didn't therefore help either. Even the good old thisisunsafe is disabled nowdays. I nearly got in with an old version of Firefox, but then it auto updated...

However, at one point I got Chrome's devtools to show the security protocols, and it said the antenna is using TLS 1.2, but also RSA, rather than ECDHE-RSA. It suggested to use ECDHE instead, so now I suspect the problem to be with that. Most of the time the security tab just stays blank.

Trying to solve this issue, I (shortsightedly) also factory reseted on of the receiving antennas. It didn't solve the issue, but instead escalated it: I can't do the setup of the antenna and connect it, so currently one branch (building) of the network is not connected.

Where to go from here? First of all, is there a quick temporary way to get in to get the reseted antenna working. Second, for the long term, is there a way to upgrade the certificates, other than buying new antennas? Also, what kind of security risks this situation poses? One AP in the network is accessible to customers.

Thanks you in advance for any assistance!

eemil
  • 1
  • 1
  • Not that I believe TP-Links cares for their more recent hardware that much more, but there are at least 3 pieces of hardware sold under that name, a good look next to the barcodes on the package or device (e.g. region+version like *EU/V3.2*) should help determine if you are better off installing your own firmware (or buying a new still vendor-supported device). – anx May 05 '23 at 16:51

1 Answers1

1

Firefox on Windows as of version 112.0.2 (released 2023-04-25) still via about:config allows configuring security.tls.version.min with a value of 1 re-enabling connections to the now deemed dangerous TLS1.0 protocol.

Be sure to reset the setting after you are done, there should be an button with an arrow to get back to the default (currently 3 indicating requiring to use use TLS1.2 or later))

That being said, hardware that has been dropped from vendor support for so long should only be run with a well-supported alternate firmware (if this is an option for you at all, I need not introduce you to possible distributions) or replaced with not only still-supported, but also wildly more powerful hardware.

anx
  • 8,963
  • 5
  • 24
  • 48