How to have RUTX11 recognize manually replaced SSL certificates?

[terrikennedy]

For various technical reasons (which I won’t go into unless you ask) I cannot use the automated certificate renewal provided by Let’s Encrypt. I have workarounds for getting updated certificates for *.example.com (obviously not my real domain name) and have automated scripts that either push or pull them to each type of device.

I have a script that copies them from my certificate repository to /etc/certificates on the RUTX11, and then does an /etc/init.d/uhttpd reload to have the RUTX11 web server use the updated certificates.

However, the RUTX11 Web UI is still reporting “Certificates will expire in less than 45 days” even after a reboot of the device, and the certificate information shown in the UI page is incorrect (it shows the new issue date, but not the new end date). Note that the certificate expiration as shown in my browser (second picture) shows the correct expiration of 25 May.

Is there some CLI routine I have to call to have RutOS either “notice” that the certificate has been replaced, or to actually install the replacement certificate? I found cert-install-vuci but it isn’t obvious if that is the correct file or what parameters it takes.

However, the correct certificate issue date and expiration is shown by the browser:

And the Web UI shows the correct issue date, but the wrong expiration date:

I could also just give up plans for using wildcard certificates on the RUTX11 devices, but the root directory of the web server is mounted read-only, so I can’t use a http-based ACME challenge as acme.sh can’t put the necessary file in the root directory of the web server:

root@RUTX11:~# cd /www
root@RUTX11:/www# ls
assets favicon.ico index.html.gz
brand fonts robots.txt
cgi-bin icons tlt_networks_logo.svg.gz
root@RUTX11:/www# touch foo
touch: foo: Read-only file system

[Vilius]

Greetings, @terrikennedy,

Thank you for reaching out.

I have forwarded the provided information to our R&D team for further investigation and will inform you as soon as there is an update on this matter.

In the meantime, your patience is greatly appreciated.

Best regards,
V.

[Vilius]

Greetings,

I hope this message finds you well.

Apologies for the delay.

Regarding the certificates, you can upload them manually through the WebUI by navigating to System → Administration → Certificates, then selecting Certificate Actions and clicking Import.

Additionally, if you prefer to use acme.sh for certificate management, you may find the following community thread helpful, where another user has shared their solution:

TRB140. Accepting POST requests from internet

Hello, Regarding the SSL/TLS certificate setup for your Teltonika TRB140 , here’s a practical approach that ensures trusted HTTPS without browser warnings: Key Points Goal: Replace the default Teltonika self-signed certificate with one from a trusted authority (e.g., Let’s Encrypt) and ensure it renews automatically. Options for TRB140: Run acme.sh directly on the router: Possible, but fragile due to limited storage, firmware quirks, and cron reliability. Run ACME client externally (recomm…

I hope this information helps.

Best regards,
V.

[terrikennedy]

I will experiment with the suggest automation when I return from my trip in May. Feel free to close this request and I’ll open a new one if necessary then.

Thanks!