Community discussions

MikroTik App
  4. RouterOS
  5. General

How to Self-Sign SSL Certificate and Activate HTTPS

Post Reply
 
quicky2g
just joined
Topic Author
Posts: 14
Joined: Wed Dec 26, 2012 7:00 am

How to Self-Sign SSL Certificate and Activate HTTPS

Fri Dec 12, 2014 1:13 am

Had to dig through a few forums to figure this out.

On MikroTik, create the certificate template and a request
Code: Select all
/certificate add name=SSL common-name=SSL key-size=2048
/certificate create-certificate-request template=SSL key-passphrase=mypassword123
You'll have to use "mypassword123" for the rest of the password prompts.

Copy these files from your MikroTik to a Linux server:

certificate-request.pem
certificate-request_key.pem

You can copy them through the web interface in the Files menu, Winbox, WinSCP (SSH), Tunnelier (SSH), Filezilla (FTP), etc.

On the Linux server navigate to the folder where the files are located via terminal
Code: Select all
openssl rsa -in certificate-request_key.pem -text > certificate-request2.pem
openssl x509 -req -days 9999 -in certificate-request.pem -signkey certificate-request2.pem -out mikrotik_ssl.crt
You can probably do the openssl portion on Windows instead of Linux, but I haven't tried. Go here for Windows binaries:
http://slproweb.com/products/Win32OpenSSL.html

Back on the MikroTik
Code: Select all
/certificate import file-name=mikrotik_ssl.crt
/certificate import file-name=certificate-request2.pem
Now print the certificate info to see the name of the imported cert for the final step
Code: Select all
[admin@MikroTik] /certificate> print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
 #          NAME                  COMMON-NAME               SUBJECT-ALT-NAME                                            FINGERPRINT
 0          SSL                   SSL
 1 K      T cert_2                SSL                                                                                   c214f22faa344c8750d8ba...
Finally, set the www-ssl service to use the certificate
Code: Select all
/ip service set www-ssl certificate=cert_2
Enjoy!
Top
 
mmihaylov
just joined
Posts: 1
Joined: Tue Apr 25, 2017 11:53 pm

Re: How to Self-Sign SSL Certificate and Activate HTTPS

Tue Apr 25, 2017 11:57 pm

Hello,
works great on RouterOS v6.18
Thank you
Top
 
User avatar
Uqbar
Member Candidate
Member Candidate
Posts: 140
Joined: Tue May 05, 2015 11:56 am
Contact:
Contact Uqbar

[SOLVED] Re: How to Self-Sign SSL Certificate and Activate HTTPS

Thu Aug 02, 2018 12:08 pm

The directions by quicky2g didn't work on v6.42.6.
First, the certificate to be used by www-ssl service isn't named "cert_2" but rather "mikrotik_ssl_.crt_0".
I presume this is just a copy+paste error.
Second, whatever certificate file I select for www-ssl I get this error on Firefox 61.0.1 (64-bit) for Linux with OpenSSL "1.1.0h 27 Mar 2018".
========
Secure Connection Failed

An error occurred during a connection to 192.168.255.252. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
========

Any hint?

[SOLVED]
I followed the relevant wiki page.
Top
 
midenok
newbie
Posts: 41
Joined: Fri Dec 27, 2013 5:34 pm

Re: How to Self-Sign SSL Certificate and Activate HTTPS

Mon Apr 22, 2019 11:48 pm

Is it possible to do passwordless login via certificates?
Top
 
User avatar
kmansoft
Frequent Visitor
Frequent Visitor
Posts: 61
Joined: Tue Jan 22, 2019 5:00 pm

Re: How to Self-Sign SSL Certificate and Activate HTTPS

Fri Apr 26, 2019 8:29 pm

Is it possible to do passwordless login via certificates?
For SSH - yes.

Import your SSH public key in System - Users - SSH Keys.

Only RSA keys are supported it seems (my usual preference is for 25519).

I've also needed this in the past in my ~/.ssh/config - until 2-3 recent version updates, RouterOS only supported HMAC SHA1. Now (6.44, 6.45) it doesn't appear to be necessary anymore.
Code: Select all
Host 192.168.88.*
	MACs hmac-sha1
	IdentityFile ~/.ssh/id_rsa_mikrotik
Top
 
lacibsd
Frequent Visitor
Frequent Visitor
Posts: 60
Joined: Thu Mar 10, 2016 9:48 pm

Re: How to Self-Sign SSL Certificate and Activate HTTPS

Sun Apr 26, 2020 11:14 pm

Very good one. Thank you! :)
Top
 
User avatar
Uqbar
Member Candidate
Member Candidate
Posts: 140
Joined: Tue May 05, 2015 11:56 am
Contact:
Contact Uqbar

Re: How to Self-Sign SSL Certificate and Activate HTTPS

Mon Apr 27, 2020 7:00 pm

I still wonder why ed25519 aren't suported yet... even dropbear supports it!
Top
Post Reply
  4. RouterOS
  5. General