Overview

/certificate

The general menu is used to manage certificates, add templates, issue certificates, and manage CRL and SCEP Clients.

Certificate Template

Certificate templates are used to prepare a desired certificate for signing.

Certificate template is deleted right after a certificate is signed or a certificate request command is executed

/certificate
add name=CA-Template common-name=CAtemp key-usage=key-cert-sign,crl-sign
add name=Server common-name=server
add name=Client common-name=client

To print out certificates:

[admin@4k11] /certificate> print detail 
Flags: K - private-key; L - crl; C - smart-card-key; A - authority; I - issued, R - revoked; E - expired; T - trusted 
 0         name="CA-Template" key-type=rsa common-name="CAtemp" key-size=2048 subject-alt-name="" days-valid=365 key-usage=key-cert-sign,crl-sign 

 1         name="Server" key-type=rsa common-name="server" key-size=2048 subject-alt-name="" days-valid=365 
           key-usage=digital-signature,key-encipherment,data-encipherment,key-cert-sign,crl-sign,tls-server,tls-client 

 2         name="Client" key-type=rsa common-name="client" key-size=2048 subject-alt-name="" days-valid=365 
           key-usage=digital-signature,key-encipherment,data-encipherment,key-cert-sign,crl-sign,tls-server,tls-client 

Certificate properties

Certificate read-only properties

After a certificate is signed, most of a certificate template properties are converted to read-only (except name and trusted)

Sign Certificate

Certificates should be signed. In the following example, we will sign certificates and add CRL URL for the server certificate:

/certificate 
sign CA-Template 
sign Client      
sign Server ca-crl-host=192.168.88.1 name=ServerCA

Let`s check is the certificates are signed:

[admin@MikroTik] /certificate> print
Flags: K - private-key; L - crl; A - authority; T - trusted
Columns: NAME, COMMON-name, FINGERPRINT
#        NAME         COMMON  FINGERPRINT                                                     
0  K AT  CA-Template  CAtemp  0c7aaa7607a4dde1bbf33deaae6be7bac9fe4064ba47d64e8a73dcefad6cfc38
1  K AT  Client       client  b3ff25ecb166ea41e15733a7493003f3ea66310c10390c33e98fe32364c3659f
2  KLAT  ServerCA     server  152b88c9d81f4b765a59e2302e01efd1fbf11ceeed6e59f4974e87787a5bb980

For a video example click here.

Export Certificate

It is possible to export client certificates with keys and CA certificates in two formats - PEM or PCKS12.

/certificate 
export-certificate CA-Template 
export-certificate ServerCA export-passphrase=yourpassphrase
export-certificate Client export-passphrase=yourpassphrase

Exported certificates are available under the /file section:

[admin@MikroTik] > file print
Columns: NAME, TYPE, SIZE, CREATION-TIME
#  NAME                         TYPE        SIZE  CREATION-TIME       
0  skins                        directory         jan/19/2019 00:00:04
1  flash                        directory         jan/19/2019 01:00:00
2  pub                          directory         jan/19/2019 02:42:16
3  cert_export_CA-Template.crt  .crt file   1119  jan/19/2019 04:15:21
4  cert_export_ServerCA.crt     .crt file   1229  jan/19/2019 04:15:42
5  cert_export_ServerCA.key     .key file   1858  jan/19/2019 04:15:42
6  cert_export_Client.crt       .crt file   1164  jan/19/2019 04:15:55
7  cert_export_Client.key       .key file   1858  jan/19/2019 04:15:55

Import Certificate

To import certificates, certificates must be uploaded to a device using one of the file upload methods.

Certificates must be imported as a file.

Supported are PEM, DER, CRT, PKCS12 formats.

[admin@MikroTik] > /certificate/import file-name=certificate_file_name name=name_example passphrase=file_passphrase
     certificates-imported: 2
     private-keys-imported: 1
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0

[admin@MikroTik] > /certificate/print 
Flags: K - PRIVATE-KEY; T - TRUSTED
Columns: NAME, COMMON-NAME
#    NAME            COMMON-NAME                                                  
0 KT name_example    cert    
1  T name_example_1  ca   

Settings

/certificate settings allows configuring Certificate Revocation List (CRL) settings.

By default, CRL is not utilized, and certificates are not verified for revocation status.

An example on importing a root certificate.

ACME client

The ACME client automates the acquisition and renewal of multiple TLS certificates via ACME.

To add a new ACME client via CLI, use the command /certificate add-acme.

Existing ACME clients appear in the Certificates view and are marked with the a (acme-manage) flag.

Domain names must resolve to the router, and TCP port 80 must be accessible from the WAN (HTTP-01 challange is used). For example.sn.mynetname.net domain name, DNS-01 challange is used.

Certificates are automatically renewed when 80% of their validity period has elapsed.

If the certificate is not retrieved during the initial setup, a new ACME client must be added.

Properties

Let's Encrypt certificate

To retrieve Let's Encrypt certificate with automatic certificate renewal, must manually provide ACME directory URL (https://acme-v02.api.letsencrypt.org/directory) and domain-name.

/certificate/add-acme directory-url=https://acme-v02.api.letsencrypt.org/directory domain-names=[DOMAIN_NAME]

To generate Let's Encrypt certificate for /ip cloud name (ie. example.sn.mynetname.net), as domain-name provide dns-name from /ip/cloud menu or use "[/ip/cloud/get dns-name]"

/certificate/add-acme directory-url=https://acme-v02.api.letsencrypt.org/directory domain-names=[/ip/cloud/get dns-name]

SCEP

SCEP is using HTTP protocol and base64 encoded GET requests. Most of the requests are without authentication and cipher, however, important ones can be protected if necessary (ciphered or signed using a received public key).

SCEP client in RouterOS will:

• get CA certificate from CA server or RA (if used);
• user should compare the fingerprint of the CA certificate or if it comes from the right server;
• generate a self-signed certificate with a temporary key;
• send a certificate request to the server;
• if the server responds with status x, then the client keeps requesting until the server sends an error or approval.

The SCEP server supports the issuance of one certificate only. RouterOS supports also renew and next-ca options:

• renew - the possibility to renew the old certificate automatically with the same CA.
• next-ca - possibility to change the current CA certificate to the new one.

The client polls the server for any changes, if the server advertises that the next-ca is available, then the client may request the next CA or wait until CA almost expires and then request the next-ca.

The RouterOS client by default will try to use POST, AES, and SHA256 if the server advertises that. If the above algorithms are not supported, then the client will try to use 3DES, DES and SHA1, MD5.

SCEP certificates are renewed when 3/4 of their validity time has passed.

Built-in trust store authorities

RouterOS contains list of built-in root certificate authorities that specific services can use for host certificate verification.

List of services that can use built-in root certificate authorities can be found here.

It is possible to use DoH, download Adlist from URL or use fetch tool with certificate validation without the need to manually import the relevant root certificate.

The list of built-in root certificate authorities is accessible in System → Certificates → Built In CA