The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser will whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked?
The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10$ router?
The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10$ router?