Difference between revisions of "Manual:System/Certificates"

From MikroTik Wiki
Jump to: navigation, search
(Self-Signed CA Management)
Line 52: Line 52:
 
Starting from RouterOS version 6 it is possible to manage and create self-signed CAs. It is not possible to import self signed CAs here. Implementation was made based on RFC 5280 and all certificates are X.509 v3.
 
Starting from RouterOS version 6 it is possible to manage and create self-signed CAs. It is not possible to import self signed CAs here. Implementation was made based on RFC 5280 and all certificates are X.509 v3.
  
 +
 +
All certificate fingerprints are SHA1. All private keys and CA export passphrase are stored encrypted with hardware ID. CRL renewal happens at every certificate revocation and after 24hours.
 +
 +
{{Note | Time and date on routers MUST be correct}}
  
 
'''Properties'''
 
'''Properties'''
 
  
 
{{Mr-arg-table-h
 
{{Mr-arg-table-h
Line 165: Line 168:
  
 
'''Commands'''
 
'''Commands'''
 +
 
{{Mr-arg-table-h
 
{{Mr-arg-table-h
 
|prop=Command
 
|prop=Command
Line 193: Line 197:
 
<p id="shbox"> <b>Sub-menu:</b> <code>/certificate ca certificate</code><br /></p>
 
<p id="shbox"> <b>Sub-menu:</b> <code>/certificate ca certificate</code><br /></p>
  
 +
'''Commands'''
 +
 +
{{Mr-arg-table-h
 +
|prop=Command
 +
|desc=Description
 +
}}
 +
 +
{{Mr-arg-ro-table
 +
|arg=create-certificate
 +
|type=
 +
|desc=
 +
}}
 +
 +
{{Mr-arg-ro-table
 +
|arg=sign-certificate-request
 +
|type=
 +
|desc=
 +
}}
 +
 +
{{Mr-arg-ro-table
 +
|arg=revoke
 +
|type=
 +
|desc=
 +
}}
 +
 +
 +
{{Mr-arg-ro-table-end
 +
|arg=export
 +
|type=name or number of cert
 +
|desc=Export certificate and private key. Difference from CA export is that private key is protected with passphrase specified during the export process. Everyone ho has rights to export can access private keys.
 +
}}
  
  
 
[[Category:Manual|C]]
 
[[Category:Manual|C]]
 
[[Category:System|C]]
 
[[Category:System|C]]

Revision as of 10:05, 25 April 2012

Version.png

Applies to RouterOS: v6.0 +

Summary

Sub-menu: /certificate
Package required: security
Standards: RFC 5280, draft-nourse-scep-22

(needs editing)

General Menu

Sub-menu: /certificate


Properties

(needs editing) ca email issuer name subject

Read-only: alias decrypted-private-key dsa invalid-after invalid-before private-key rsa serial-number


Commands (needs editing) create-certificate-request decrypt import reset-certificate-cache


Self-Signed CA Management

Sub-menu: /certificate ca


Starting from RouterOS version 6 it is possible to manage and create self-signed CAs. It is not possible to import self signed CAs here. Implementation was made based on RFC 5280 and all certificates are X.509 v3.


All certificate fingerprints are SHA1. All private keys and CA export passphrase are stored encrypted with hardware ID. CRL renewal happens at every certificate revocation and after 24hours.

Icon-note.png

Note: Time and date on routers MUST be correct


Properties

Property Description
alias ()
common-name (string)
country (string)
crl-host (string)
email (string)
expired (yes | no)
fingerprint (string)
invalid-after (date)
invalid-before (date)
issuer (string)
locality (string)
name (string)
organization (string)
self-signed (yes | no)
serial-number (string)
state (string)
unit (string)


Commands

Command Description
create-self-signed-ca () Creates self signed CA and generates key. Required extensions are export passphrase (which is used to protect private key when user tries to export it), validity period and IP address.
export (name or number of cert) Exports certificate and private key which is encrypted with provided passphrase.
remove (name or number of cert) Remove specified CA and all linked certificates.


Self-signed Certificates

Sub-menu: /certificate ca certificate

Commands

Command Description
create-certificate ()
sign-certificate-request ()
revoke ()
export (name or number of cert) Export certificate and private key. Difference from CA export is that private key is protected with passphrase specified during the export process. Everyone ho has rights to export can access private keys.