SSL Certificates and ISY Launcher

[matapan]

First, let me say that I have very little knowledge or understanding of web security. As a user, all I really care about is being able to access the application in question. 

 

That said, I have followed the advice regarding the use of ISY Launcher to start the Admin Console on my local area network.

I wish to access the Admin Console when I am outside of my local area network.To that end, I have set up the port forwarding necessary to access the ISY externally.

I obtained the IP address my home connection uses, then set up an entry in the ISY launcher to access the Admin Console externally.

After successfully launching the Admin Console, I get an error saying that my security certificate is expired and I need to update it.

In the AC Help dropdown, there is a menu pick for managing certificates, but it brings up nothing when invoked. 

Found a post from another user on this forum about the same issue with certificate management, but the ensuing discussion is over my head.

What is required to access the Admin Console externally without certificate errors? Thanks.

[larryllix]

Much simpler and safer to access your ISY via the ISY Portal, using pulldown menus inside it.

There have been many reports of hacking people using port forwarding. Not really recommended. Also while I was away on a cruise, my power went down long enough that my ISP issued me a new IP address (first time in 8 years),  and I had no access until I got home.

[DennisC]

I would agree that use of the UD Portal simplifies reaching your ISY or IoP by computer or with UD Mobile.

The cost for two years is minimal and once you have the key you can enter it right in the ISY Launcher if you are using your computer away from home to access the admin console.

[MrBill]

I agree with @larryllix but i'll add some more commentary...

Opening ports is the old way, don't do it.  You defined the reason yourself, security. 

Instead is the new way... the ISY Portal.  For instructions to set up admin access through the portal see this wiki page.

 

[matapan]

So thank you to all who have responded.I have a portal subscription already and accessing the ISY this way is fine. 

One has to ask why the menu pick for managing certificates hasn't been removed from the Admin Console. It seems to serve no purpose based on the lack of functionality and rationale described here, only serving to be a potential unnecessary call or support request generator. Why not clean up the UI?

[MrBill]

22 minutes ago, matapan said:

One has to ask why the menu pick

UDI is very careful to keep historic functionality in place. The only time functionality is deprecated or removed is when it's function stands in the way of new functionality or concepts.    It can be done the way you were attempting, and many people for one reason or another still use that functionality, but its not modern day best practice.  Removing functionality can generate an avalanche of support tickets as well.

[matapan]

Selecting the menu pick does nothing, as others have pointed out. If the new way to access ISY externally is via the portal, why keep this at all?

[MrBill]

39 minutes ago, matapan said:

Selecting the menu pick does nothing, as others have pointed out. If the new way to access ISY externally is via the portal, why keep this at all?

if you're speaking of this option:

 

It should open a pdf https://www.universal-devices.com/docs/ISY994 Series Network Security Guide.pdf in a browser window, (or in my case it opens in acrobat reader, but I made a change to windows file associations manually).

[matapan]

Yes, that is the menu pick. I am not the only user who noticed nothing happens when activating this pick. Not sure why. 

[lilyoyo1]

On 2/18/2022 at 10:42 AM, matapan said:

Selecting the menu pick does nothing, as others have pointed out. If the new way to access ISY externally is via the portal, why keep this at all?

Options! 

Not everyone wants to use the portal. There are those with the knowledge, skill, resources, etc. to create and manage their own certificates. For them, they want everything self enclosed. Using the portal would defeat that. For the majority of users however, the portal is a welcome expense.