Community discussions

MikroTik App
 
aseques
newbie
Topic Author
Posts: 26
Joined: Fri Oct 10, 2014 10:04 am

Certificates in DER or CER format?

Thu Dec 15, 2016 2:24 pm

Hello, I have looking into the forums and couldn't find an aswer. I want to enable https on webfig. I uploaded a cert and a key to my router and enabled www-ssl

Basically (once files were in place) I just did..
/certificate import file-name=cert_ge.crt
/certificate import file-name=cert.key
/ip  service enable www-ssl
The problem is that if I upload the certificate in CER format (plain text) such as:
-----BEGIN CERTIFICATE-----
MIIDFjCCAf6gAwIBAgIBAjANBgkqhkiG9w0BAQsFADB5MR8wHQYDVQQDDBZkc2ku
...
-----END CERTIFICATE-----
I can see it being imported and it appears in the certificate store, but I can't acces to the https url for the router.

But if I use the certificate in DER format (binary), it just works.

It's weird because I am always uploading the key in plain
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOQ/mRBjjnZPr+Ds
....
-----END PRIVATE KEY-----

Does anyone have an explanation for this? I'd rather upload the files in CER format because it's more convenient for me

UPDATE: Both type of certs are fine, the issue was related on not choosing the proper one for the https connection, see the post at the end for the full explanation
Last edited by aseques on Fri Dec 16, 2016 11:36 am, edited 1 time in total.
 
Van9018
Long time Member
Long time Member
Posts: 558
Joined: Mon Jun 16, 2014 6:26 pm
Location: Canada - Abbotsford

Re: Certificates in DER or CER format?

Fri Dec 16, 2016 11:19 am

I'm able to...

Mine is plain text and opens in notepad, starts with -----BEGIN CERTIFICATE----- then a long base64. My private key is plain text too. I'm using routerOS version 6.35.2

Filename is cert.crt

In the list of certificates, mine says KAT. K signifies that a private key is associated with the certificate.

I've just enabled https with my cert in IP > Services and was able to connect webfig via https...
 
aseques
newbie
Topic Author
Posts: 26
Joined: Fri Oct 10, 2014 10:04 am

Re: Certificates in DER or CER format?

Fri Dec 16, 2016 11:34 am

I finally found what was wrong, it was my fault indeed, I was enabling the www-ssl service but I didn't specify the certifcate to use, so it used none as the cipher (don't know if this is a bug or it's done on purpose). It might have picked my cert somehow as it was the only one available, but didn't show any errors or complain.

You can do:
/ip service set www-ssl disabled=no
But it will be equivalent to
/ip service set www-ssl disabled=no certificate=none
And it will end with firefox showing a message like this
(Error code: ssl_error_no_cypher_overlap)

It was fixed by setting the proper certificate value.