Starting from RouterOS version 6 it is possible to manage and create self-signed CAs. It is not possible to import self signed CAs here. Implementation was made based on RFC 5280 and all certificates are X.509 v3.
'''Properties'''
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
{{Mr-arg-ro-table
|arg=alias
|type=
|desc=
}}
{{Mr-arg-ro-table
|arg=common-name
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=country
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=crl-host
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=email
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=expired
|type=yes {{!}} no
|desc=
}}
{{Mr-arg-ro-table
|arg=fingerprint
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=invalid-after
|type=date
|desc=
}}
{{Mr-arg-ro-table
|arg=invalid-before
|type=date
|desc=
}}
{{Mr-arg-ro-table
|arg=issuer
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=locality
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=name
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=organization
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=self-signed
|type=yes {{!}} no
|desc=
}}
{{Mr-arg-ro-table
|arg=serial-number
|type=string
|desc=
}}
{{Mr-arg-ro-table
|arg=state
|type=string
|desc=
}}
{{Mr-arg-ro-table-end
|arg=unit
|type=string
|desc=
}}
'''Commands'''
{{Mr-arg-table-h
|prop=Command
|desc=Description
}}
{{Mr-arg-ro-table
|arg=create-self-signed-ca
|type=
|desc=Creates self signed CA and generates key. Required extensions are export passphrase (which is used to protect private key when user tries to export it), validity period and IP address.
}}
{{Mr-arg-ro-table
|arg=export
|type=name or number of cert
|desc=Exports certificate and private key which is encrypted with provided passphrase.
}}
{{Mr-arg-ro-table-end
|arg=remove
|type=name or number of cert
|desc=Remove specified CA and all linked certificates.
}}
===Self-signed Certificates===
<p id="shbox"> <b>Sub-menu:</b> <code>/certificate ca certificate</code><br /></p>
Starting from RouterOS version 6 it is possible to manage and create self-signed CAs. It is not possible to import self signed CAs here. Implementation was made based on RFC 5280 and all certificates are X.509 v3.
Properties
Property
Description
alias ()
common-name (string)
country (string)
crl-host (string)
email (string)
expired (yes | no)
fingerprint (string)
invalid-after (date)
invalid-before (date)
issuer (string)
locality (string)
name (string)
organization (string)
self-signed (yes | no)
serial-number (string)
state (string)
unit (string)
Commands
Command
Description
create-self-signed-ca ()
Creates self signed CA and generates key. Required extensions are export passphrase (which is used to protect private key when user tries to export it), validity period and IP address.
export (name or number of cert)
Exports certificate and private key which is encrypted with provided passphrase.
