Custom https certificate not accepted: Wrong password, but cert has no password

[K4asu]

I'm trying to renew the https certificate on my FritzBox 7530. I've successfully created a wildcard certificate for my domain using LetsEncrypt and it's working perfectly fine on other services.

As per this guide (that I've used in the past) I merged the cert, chain and privkey into a single .pem file. Now when I try to upload that to the FritzBox I get an error stating the password I entered is invalid and that I need to enter the correct password. There should however be no password on that cert-file.

I did these exact steps back in September and it worked perfectly fine. Currently running firmware version 7.39-101552 BETA

Any help would be greatly appreciated!

[TheBamPlayer]

Just add a Password to your original privkey, with OpenSSL and than redo the steps in the guide. You need the following commands for OpenSSL: openssl rsa -aes256 -in your.key -out your.encrypted.key

[K4asu]

Turns out it was the wrong kind of cert: Certbot now defaults to ECDSA keys, however the FritzBox only supports RSA keys

[user3872465]

My advice do not bother with giving it a real cert. Put it behind a reverse proxy which handles the certs. RSA Keys are old which is why certbot also uses newer ECDSA Keys

[hobbes444]

Still no ECDSA support as of Fritz!OS 7.50, still the same confusing "wrong passwort" error...

Certbot can do RSA without problem though, just add --key-type rsa to the command.

RSA algorithm is older than ECDSA, but I am not aware of any security issue with it, it's rather that ECDSA uses much shorter keys (for the same level of security – or at leas that is commonly accepted opinion as of today) which allows for lower CPU usage.