Manual:Create Certificates: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
Line 29: Line 29:


And again during the process you will have to fill some entries. When filling CN remember that it must not match on CA and server certificate otherwise later naming collision will occur.
And again during the process you will have to fill some entries. When filling CN remember that it must not match on CA and server certificate otherwise later naming collision will occur.
{{ Note |  Common Name (CN) should match the DNS name, or the IP address of your server otherwise you will get <b>"domain mismatch"</b> message and for example Windows [[Manual:Interface/SSTP | SSTP]] client will not be able to connect to the server.}}
{{ Note |  Common Name (CN) in server certificate should match the DNS name, or the IP address of your server otherwise you will get <b>"domain mismatch"</b> message and for example Windows [[Manual:Interface/SSTP | SSTP]] client will not be able to connect to the server.}}


<li> Client key/certificate pair creation steps are very similar to server. Remember to Specify unique CN.
<li> Client key/certificate pair creation steps are very similar to server. Remember to Specify unique CN.

Revision as of 14:12, 3 February 2012

Following is a step-by-step guide to creating your own CA (Certificate Authority) with openssl on Linux.

Generate certificates

Icon-warn.png

Warning: RouterOS does not support keys in pkcs8 format. To import keys in pkcs8 format run command:
openssl rsa -in myKey.key -text and write key output to new file. Upload new file to RouterOS and import


  • First step is to build the CA private key and CA certificate pair.
    openssl genrsa -des3 -out ca.key 4096
    openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
    

    During the process you will have to fill few entries (Common Name (CN), Organization, State or province .. etc). Created CA certificate/key pair will be valid for 10 years (3650 days).

  • Now create private-key/certificate pair for the server
    openssl genrsa -des3 -out server.key 4096
    openssl req -new -key server.key -out server.csr
    
    openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
    

    And again during the process you will have to fill some entries. When filling CN remember that it must not match on CA and server certificate otherwise later naming collision will occur.

    Icon-note.png

    Note: Common Name (CN) in server certificate should match the DNS name, or the IP address of your server otherwise you will get "domain mismatch" message and for example Windows SSTP client will not be able to connect to the server.


  • Client key/certificate pair creation steps are very similar to server. Remember to Specify unique CN.
    openssl genrsa -des3 -out client.key 4096
    openssl req -new -key client.key -out client.csr
    
    openssl x509 -req -days 3650 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
    

To examine certificate run following command:

openssl x509 -noout -text -in server.crt -purpose

Import certificates

To import newly created certificates to your router, first you have to upload server.crt and server.key files to the router via FTP. Now go to /certificate submenu and run following commands:

[admin@test_host] /certificate> import file-name=server.crt
passphrase: 
     certificates-imported: 1
     private-keys-imported: 0
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0
[admin@test_host] /certificate> import file-name=server.key 
passphrase: 
     certificates-imported: 0
     private-keys-imported: 1
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0

If everything is imported properly then certificate should show up with KR flag.

[admin@test_host] /certificate> print 
Flags: K - decrypted-private-key, Q - private-key, R - rsa, D - dsa 
 0 KR name="cert1" subject=C=LV,ST=RI,L=Riga,O=MT,CN=server,emailAddress=xxx@mt.lv 
      issuer=C=LV,ST=RI,L=Riga,O=MT,CN=MT CA,emailAddress=xxx@mt.lv serial-number="01"
      email=xxx@mt.lv invalid-before=jun/25/2008 07:24:33 
      invalid-after=jun/23/2018 07:24:33 ca=yes 

Icon-note.png

Note: If you want to use server certificates for OVPN or SSTP and use client certificate verification, then CA certificate must be imported, too.


[ Top | Back to Content ]