Usually we use the following script for creating CA and server certificate for OpenVPN:
Code: Select all
## generate a CA certificate
/certificate
add name=ca-template country="$COUNTRY" state="$STATE" locality="$LOC" \
organization="$ORG" unit="$OU" common-name="$CN" key-size="$KEYSIZE" \
days-valid=3650 key-usage=crl-sign,key-cert-sign
sign ca-template ca-crl-host=127.0.0.1 name="$CN"
:delay [$waitSec]
## generate a server certificate
/certificate
add name=server-template country="$COUNTRY" state="$STATE" locality="$LOC" \
organization="$ORG" unit="$OU" common-name="server@$CN" key-size="$KEYSIZE" \
days-valid=3650 key-usage=digital-signature,key-encipherment,tls-server
sign server-template ca="$CN" name="server@$CN"
:delay [$waitSec]Therefore, we've exportet all certificates+key encrypted as p12-file and made a cleartext-backup of the mikrotik.
After importing CA and certificates we saw a strange problem.
The CA is still shown with the correct flags "KLAT".
But the signed certificate changed from "KI" to "KT". Also the information of the CA is missing.
We've tried several imports/exports for e.g exporting/importing cert and key separately.
Also we've used the same names for all certificates.
Is there any way to import the certificates and the CA correctly without loosing the reference between CA and certificate?
It would be really a ton of work to issue new certificates for all clients...
I've found some posts about that problem, none of them had a clear/working solution :/
BR
