我的學習手記 A technical geek blog

Saturday, September 20, 2025

TP-Link TL-WR1502X Travel Router firmware upgrade version 1.1.1

How to resolve SSL error when access website which is using Hong Kong Post CA issued SSL cert?

When using Google Chrome to access, there are error message: "NET::ERR_CERT_AUTHORITY_INVALD"

Missing Cert on client machine:

Download:

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_root_3.zip

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_root_3_cross_signed_by_globalsign_car3.zip

https://www.digitalpolicy.gov.hk/en/our_work/digital_infrastructure/legal_framework/regulation/eto/doc/hk_post_e-cert_ssl_3-17.zip

You can use www.ssllab.com to check the website SSL cert's cert path to see any SSL cert is missing on your laptop.

Reference:

有關郵政署署長的披露紀錄-頁1 | 數字政策辦公室

Cisco ISR 4431 firmware upgrade from 17.03.04a to 17.09.07a

You can upgrade from 17.03.04a to 17.09.07a directly

The upgrade will take about 30 mins.

#1 Copy the image to the router and backup the config

#####USB#####

copy usb0:isr4400-universalk9.17.09.07a.SPA.bin bootflash:

copy system:running-config usb0:

####TFTP####

copy tftp:<ip>/isr4400-universalk9.17.09.07a.SPA.bin bootflash:

copy system:running-config tftp:<ip>

####FTP####

copy ftp://<username>:<password>@<location/directory> bootflash:

copy system:running-config ftp://<username>:<password>@<location/directory>

#Example

copy ftp://admin:123456@10.10.10.1/root bootflash:isr4400-universalk9.17.09.07a.SPA.bin

#2 Verify IOS checksum

FileName : isr4400-universalk9.17.09.07a.SPA.bin

MD5 Checksum : 528c1c9424508bb5748217191a51012c

verify /md5 bootflash:isr4400-universalk9.17.09.07a.SPA.bin

#3 Verify the status of router

ter len 0

Sh clock

Show ip int brief

Show int des

Show ip ospf nei

Show ip arp

Show ver

Show cdp nei

Show run

show ip ospf neighbor

show crypto isa sa

show crypto sess brief

Sh ip route sum

Sh int trunk

Sh interface

Sh proc cpu his

sh inv

Sh environment all

sh license usage

sh license summary

sh license all

sh platform

sh platform hardware throughput crypto

sh platform hardware throughput level

Sh inter transceiver

Sh mac-add

Sh stand b

ter len 24

wr mem

#4a Upgrade the router

config t

no boot system

boot system flash bootflash:isr4400-universalk9.17.09.07a.SPA.bin

end

wr mem

#4b Verify the next bootfile of router

show boot

#Ensure it show your target IOS

#BOOT variable = bootflash:/<image.bin>,12;

reload

#4c *After reload* Verify the Version of router

show version

#5 Delete the old image

delete bootflash:<image.bin>

#6 Compare the configuration before and after upgrade software and verify the status of router

ter len 0

Sh clock

Show ip int brief

Show int des

Show ip ospf nei

Show ip arp

Show ver

Show cdp nei

Show run

show ip ospf neighbor

show crypto isa sa

show crypto sess brief

Sh ip route sum

Sh int trunk

Sh interface

Sh proc cpu his

sh inv

Sh environment all

sh license usage

sh license summary

sh license all

sh platform

sh platform hardware throughput crypto

sh platform hardware throughput level

Sh inter transceiver

Sh mac-add

Sh stand b

ter len 24

wr mem

How to resolve the Adobe Reader or Adobe Acrobat auto close recently due to the bug

Download the Aug 2025 version

https://www.adobe.com/devnet-docs/acrobatetk/tools/ReleaseNotesDC/continuous/dccontinuousaug2025.html

(Optional) Install the optional update

https://www.adobe.com/devnet-docs/acrobatetk/tools/ReleaseNotesDC/continuous/dccontinuousaug2025qfe2.html

Wednesday, September 3, 2025

Opnsense setup on Vmware ESXi 8.0 to running for proxy mode with one network card only

Requirement:

Setup a proxy appliance which is running on VMware ESXi 8.0 with one network card only

One VMware, select boot from ISO and also using FreeBSD 13.0 template
Create a self sign cert for SSL proxy (Go to "System -> Trust -> Authorities")
Select "Community Plug-in" to search for "os-squid"
After install this plug-in, you will able to go to "Web Proxy" to continue the proxy setup

Reference:

https://forum.opnsense.org/index.php?topic=36454.0

https://docs.opnsense.org/manual/how-tos/proxytransparent.html

https://forum.opnsense.org/index.php?topic=38734.0

https://docs.opnsense.org/manual/how-tos/self-signed-chain.html

https://forum.opnsense.org/English_Forums/General_Discussion/Web_and_Content_Filter

https://forum.opnsense.org/index.php?topic=7198.0

https://forum.opnsense.org/index.php?topic=22117.0

https://docs.opnsense.org/manual/how-tos/proxywebfilter.html

https://forum.opnsense.org/index.php?topic=42497.0