WRT54G ver. 5 HTTPS Access

Question

What must I do to obtain and install a valid SSL Certificate for the Linksys WRT54G version 5 router??   Secure access is essential for remote administration.
Using Administration > Web Access, I enabled (only) HTTPS for secure access.  At some point, the user interface apparently launched a "wizard" which proceeded to create a "certificate".  However, when I subsequently tried to access the router with IP https://192.168.1.1  Firefox 3.0.4 reported:
192.168.1.1 uses an invalid security certificate.
The certificate is not trusted because it is self signed.
The certificate is only valid for <a id="cert_domain_link" title="Linksys">Linksys</a>
(Error code: sec_error_ca_cert_invalid)
What must I do to obtain and install a valid SSL Certificate for the Linksys WRT54G version 5 router??  Firefox will not display the log-on dialog, thus it will not allow access to the router.  Internet Explorer 7 also displays an error message that is rather vague and cryptic, and it also does not allow access to the router.  Neither Firefox nor I.E. have a "security certificate" that pertains to the router, only one to send when a server requests it.
According to Linksys, the most recent revision of the WRT54G firmware is installed. 
What must I do to obtain and install a valid SSL Certificate for the Linksys WRT54G version 5 router??
--- Stardance
Stardance
nil carborundum illegitimi!

Answer 1

For Firefox click on "Or you can add an exception…", press the "Add Exception..." button, in the new popup, press the "Get Certificate" button, make sure to "Permanently store this exception" and press the "Confirm Security Exception" button. That's it. This is what I meant with "accepting the certificate". If that does not work in your Firefox then it must be a Firefox problem on your computer. It works fine on my computer and it seems to work fine with Internet Explorer on your computer.
If you want to examine the certificate you can do so, after you have pressed the Get Certificate button. It is a self-signed certificate with name "Linksys". It is stored in the router.
If you "Confirm Security Exception" in Firefox the certificate is stored in the "Certificate Manager" (Tools - Options - Advanced - View Certificates). There you can remove it again if you don't want it anymore. Internet Explorer works similar and also has a certificate manager.
So on my computer both Firefox and Internet Explorer behave the same even if they call and label things differently. They both see the self-signed certificate from the router and require you to manually accept the connection before you can continue. On both you will get to the router web interface. On both you have the choice to permanently remember the certificate. I see no substantial difference between Internet Explorer and Firefox in this respect.
Re (1) You wanted to know how to create a valid SSL certificate on the router. First of all, the certificate presented is the certificate which identifies the router. Of course, you see this error message because the router has only a dummy certificate installed which allows you to use SSL, but it won't correctly identify the router.
Thus what you write in (1) about the computer is irrelevant. It is not the computer which identifies itself but the router. You connect to the HTTPS server on the router. The HTTPS server on the router has the certificate. This certificate is supposed to identify the HTTPS server. If you click on https://mail.google.com or some other standard https website in the internet which has a valid correct certificate you can right-click into the web site in Firefox and choose "Page Info". Click on Security. It shows you some information on the certificate. For more details press "View Certificate".
There are two essential parts:
A. "Issued To". This section contains the hostname to which you are connected to. This is "mail.google.com". If this does not match with the hostname in the URL then you will get a certificate error message. If you use one of the IP addresses of mail.google.com https://66.249.89.18/ instead, you'll see a certificate error message, simply because the 66.249.89.18 is not the same as mail.google.com which is in the certificate.
B. "Issued By". This is the issuer of the certificate, i.e. the "Certification Authority" which issued the certificate. You see "Thawte SGC CA" there. If you click on "Details" in the Certificate Viewer you'll see that actually the "Thawte SGC CA" certificate was itself issued by Verisign. The Verisign certificate is a "Builtin Object Token" of Firefox, i.e. by default Firefox trusts everything which is signed by Verisign and anything which is signed by anyone who was signed by Verisign, etc. Windows has the Verisign certificate built-in, too.
The router certificate is self-sign and has now proper "Common Name" set. The common name is "Linksys". This is in the Issued To and Issued By sections, which means the certificate was signed with the own key.
In order to be a "valid SSL certificate" which is accepted without any user interaction, the certificate must
(i) contain the correct hostname/IP address in the "Common Name", i.e. it must be identical to what you enter in the URL.
(ii) it must be signed by Verisign or similar.
(iii) it must not be expired.
(iv) installed inside the router.
But again, the problem is:
Re (i): the router has 192.168.1.1 in the LAN, but unknown IP addresses and hostnames in the internet. It is impossible to preinstall a correct certificate on the router except for 192.168.1.1 with obviously little effect on the remote management access through the internet which uses the public IP address.
Re (ii): to obtain a Verisign certificate the router would have to submit a certificate request to Verisign, pay the $$$ bill, wait for the certificate to be issued and then install it. Of course, Verisign won't create a certificate for 192.168.1.1 and they will probably verify that the public IP address or the hostname given is really yours.
Re (iii): Verisign server certificates expire after one year. You have to renew the certificate and pay $$$ again.
So the only really feasible way to get a "valid SSL certificate" into the router would be to add some function to the interface which allows you to either upload a certificate&key to the router or to download a certificate request from the router and upload a certificate. With the request you could go to Verisign and get a certificate issued. This is what Google does for Google Mail. They create the certificate request for mail.google.com, pay the hefty bill and get the certificate from Thawte/Verisign.
For Google it is worth it. I doubt it is worth it for your $50 router to buy a one-year certificate signed by Verisign costing probably $500 or more just for the sole purpose that you can open your remote management interface without an error message which requires you to add an exception the first time you access the page.
Re (2). I hope the above makes clear why the router does not come with a Verisign certificate. Of course Linksys could buy one certificate from Verisign for 192.168.1.1 (in case they would do that). But what would be the benefit of that? You still have the same issue with the remote management interface as it ends on a different IP address. And still, all Linksys routers would come with the same certificate, i.e. even if you connect to the router with HTTPS you still won't be able to identify if it is really your router or not from the certificate presented. So basically, the self-signed dummy certificate "Linksys" or any "better" certificate won't make any real difference: you still will have to add exceptions to firefox for remote management and the certificate itself still won't make anything more secure then what you already have due to the HTTPS connection.
Re (3) The router works as server. As web server. You access the web server inside the router to access the web interface of the router. If you open http://192.168.1.1/ your browser connects to the web server in the router presenting you with the current configuration inside the router and options to reconfigure it.
So to answer your questions:
Q: (1) who is responsible for creating the SSL certificate?"
A: Linksys
Q: and (2) why is an invalid SSL certificate created?
A: It is not invalid. It is a valid X509 certificate. It is self-signed. That Firefox calls it "invalid" is unfortunate because it is fully valid. However, it is not signed by a trusted CA and thus Firefox won't trust it automatically, unlike mail.google.com.
Q: Since Cisco/Linksys chose to include secure access in its design of the router, what is Linksys doing to prevent the creation of invalid certificates for its router?
A: They offer you to connect to the router through a HTTPS connection. Within reasonable means this is the only thing they can do. Anything else would costs much. I doubt you would still buy the router if it cost $500 but had a Verisign SSL certificate.