Secure Tunnels · Topic 3 of 3

SSTP with Certificates

Learn how SSTP carries PPP over TLS, why it passes through firewalls on TCP 443, and how to set up an SSTP server and client with certificates on RouterOS.

5 min

In a nutshell

SSTP carries PPP inside a TLS connection.
The default port is TCP 443, which passes most firewalls.
The server needs a certificate, set with certificate= on the SSTP server.

What it is

SSTP is a VPN that carries PPP traffic inside a TLS connection, the same technology that protects HTTPS.

Because it looks like ordinary secure web traffic, it passes through most firewalls and proxies. This makes it useful for users on hotel or office networks that block other VPN protocols.

SSTP depends on certificates. The server proves its identity with a certificate, and the client can check it. This page brings together the certificate skills from the Cryptography chapter.

How it works

TLS protects the connection, and PPP inside it checks the user and gives the client an address.

The layers

Layer	Job
TLS	Encrypts the connection and proves the server identity with a certificate
SSTP	Carries PPP frames inside the TLS session
PPP	Checks the user name and password and assigns an address

The default TCP port is 443. This is the same port as HTTPS, which is why SSTP crosses firewalls so easily. It also means that a router cannot give the same port to both SSTP and the HTTPS web interface without a change.

Certificates for SSTP

The server needs a certificate that matches the name or address that clients use. A client that checks the server certificate must trust the CA that signed it.

Plan the certificates first. Create a CA, sign the server certificate, and make sure that the common name or the alternative name holds the address that clients type in. The Certificates in RouterOS page shows these commands.

/certificate add name=local-ca common-name=local-ca key-usage=key-cert-sign,crl-sign
/certificate sign local-ca
/certificate add name=sstp-server common-name=vpn.example.com subject-alt-name=DNS:vpn.example.com key-usage=digital-signature,key-encipherment,tls-server
/certificate sign sstp-server ca=local-ca

Server configuration

The server uses the same PPP parts as other tunnels. You need a pool, a profile, a user and the SSTP server with a certificate.

/ip pool add name=vpn-pool ranges=192.168.89.10-192.168.89.50
/ppp profile add name=vpn-profile local-address=192.168.89.1 remote-address=vpn-pool
/ppp secret add name=alice password=UseALongPassword service=sstp profile=vpn-profile
/interface sstp-server server set enabled=yes certificate=sstp-server default-profile=vpn-profile authentication=mschap2

The firewall must accept the TLS port.

/ip firewall filter add chain=input protocol=tcp dst-port=443 action=accept

If the HTTPS web interface uses port 443 too, move one of them. Change the port of www-ssl, or set another port on the SSTP server.

Client configuration

The client must trust the CA certificate. On a RouterOS client, import the CA certificate first, and then create the client interface.

/certificate import file-name=local-ca.crt
/interface sstp-client add name=to-office connect-to=vpn.example.com user=alice password=UseALongPassword verify-server-certificate=yes verify-server-address-from-certificate=yes

The verify-server-certificate setting makes the client check that the server certificate comes from a trusted CA. The verify-server-address-from-certificate setting checks that the address that the client connected to is in the certificate.

Mutual certificates

The server can also ask the client for a certificate. This adds a second proof of identity, besides the user name and password.

/interface sstp-server server set verify-client-certificate=yes
/interface sstp-client set to-office certificate=client-cert

The client certificate must be signed by a CA that the server trusts. This is stronger, because a stolen password is no longer enough.

Checking

/interface sstp-server print
/ppp active print
/certificate print

The first command shows the connected SSTP interfaces, and the second lists active PPP users. The third lets you check that the certificates are present and that the router holds the private key where needed.

SSTP compared with L2TP and IPsec

Point	L2TP with IPsec	SSTP
Ports	UDP 500, 1701, 4500 and ESP	TCP 443
Encryption by	IPsec	TLS
Needs	Shared secret or certificates	Server certificate
Firewall friendly	Less	More

Exam tip

If the client reports a certificate error, check three things in order. The name must match, the CA must be trusted and the dates must be valid.

What to remember for the exam

Seven facts summarise SSTP.

SSTP carries PPP inside a TLS connection.
The default port is TCP 443, which passes most firewalls.
The server needs a certificate, set with certificate= on the SSTP server.
The client must trust the CA and can check the server name.
verify-server-certificate and verify-server-address-from-certificate are client side checks.
verify-client-certificate=yes on the server makes the client present a certificate too.
A conflict can occur if the HTTPS web interface also uses port 443.

Common mistakes

Four mistakes appear with SSTP.

Using a certificate whose name does not match. The client connects by a name or address that is not in the certificate, and the check fails.

Not installing the CA on the client. The client cannot validate the chain, so the connection is refused.

Letting HTTPS and SSTP fight over port 443. Only one service can use the port, so change one of them.

Forgetting the PPP parts. Without a profile, a pool and a secret, the TLS session starts but the user cannot log in.

Watch out

A wrong clock on the router or the client can make a valid certificate look expired. Check the time before you look for other causes.

Check yourself

Work through these three questions.

Why does SSTP pass through most firewalls?
It uses TLS on TCP port 443, so it looks like ordinary HTTPS traffic.
Which two settings does the SSTP client use to check the server certificate?
They are verify-server-certificate and verify-server-address-from-certificate. The first checks the CA, and the second checks the address in the certificate.
What does verify-client-certificate=yes add on the server?
The client must also present a certificate that a trusted CA signed. This is a second proof of identity besides the password.

Topic 3 of 3 in Secure Tunnels

Test yourself on Secure Tunnels

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.