Certificates in RouterOS

What it is

A certificate on a router gives a service a verified identity and lets the service encrypt its connections.

There are two ways to get one. You can make your own with a private CA, which is free and fast but trusted only where you install it. Or you can obtain a free certificate from a public authority that every client already trusts.

Whichever way you choose, the last step is the same. You assign the certificate to the service that needs it.

How it works

You create keys and certificates in the certificate menu, sign them, and then select them in the service settings.

Self signed certificates

The usual method is to make a small private CA on the router and sign a server certificate with it. First create and sign the CA certificate.

/certificate add name=local-ca common-name=local-ca key-usage=key-cert-sign,crl-sign days-valid=3650
/certificate sign local-ca

Then create the server certificate for the router name and sign it with the CA.

/certificate add name=router-cert common-name=router.example.com subject-alt-name=DNS:router.example.com key-usage=digital-signature,key-encipherment,tls-server days-valid=365
/certificate sign router-cert ca=local-ca

The validity periods are example values.

The common-name is the name of the owner. The subject-alt-name lists the names that clients may use, and modern clients check it. The key-usage lists what the certificate may be used for.

You can also use a single self signed certificate with no CA. It works for tests, but every client must trust that exact certificate.

Trusting a private CA

A client trusts the server certificate only if it trusts the CA that signed it. Export the CA certificate and install it on each client.

/certificate export-certificate local-ca file-name=local-ca

The export writes a certificate file that you copy to the client and add to its trust store. Do not export the private key of the CA unless you have a reason and protect the file.

Free valid certificates

A public authority such as Let's Encrypt issues certificates for free. Browsers and operating systems already trust these authorities, so clients need no extra installation.

The authority checks that you control the name, usually through a public web server or a DNS record. Because the router name must be reachable for this check, many people request the certificate on another machine and bring it to the router.

/certificate import file-name=fullchain.pem passphrase=""
/certificate import file-name=privkey.pem passphrase=""

The first command imports the certificate file. The second imports the private key.

If the authority gives you the chain as separate files, import those too. Free certificates are valid for a short time, so you must renew and import again before they expire.

Some RouterOS releases include a built in way to request a certificate from Let's Encrypt, so check what your version offers.

Using certificates in RouterOS

Once a certificate is on the router, you select it in the service. Each service has its own certificate setting.

/ip service set www-ssl certificate=router-cert disabled=no
/ip service set api-ssl certificate=router-cert disabled=no

After you assign the certificate, a browser that trusts the CA opens the web interface without a warning.

Checking the result

/certificate print
/ip service print

Look for the K flag, which shows that the router holds the private key. The service listing shows which certificate each service uses. If a client still warns, check the name, the dates and whether the client trusts the CA.