Certificate Management in MikroTik: SSL and HTTPS Admin

Certificate Management on MikroTik RouterOS

Certificates in RouterOS are used for HTTPS (WebFig over SSL), IPsec/IKEv2 VPN authentication, SSTP VPN, and the API over TLS. Understanding how to create, import, and manage certificates prevents expired-certificate outages and enables secure encrypted management.

Types of Certificates in RouterOS

1. Self-signed: created on the router, not trusted by browsers by default
2. CA-signed: signed by an internal CA or public CA (Let's Encrypt), trusted by clients
3. Imported: external certificates uploaded to the router

Creating a Self-Signed CA and Certificate

# Create the CA certificate
/certificate add name=my-ca common-name=MyCA key-size=4096 days-valid=3650 key-usage=crl-sign,key-cert-sign
/certificate sign my-ca

# Create a server certificate signed by the CA
/certificate add name=webfig-cert common-name=router.lab.local days-valid=365 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
/certificate sign webfig-cert ca=my-ca

Assigning Certificate to HTTPS (WebFig)

/ip service set www-ssl certificate=webfig-cert disabled=no
/ip service disable www

Now WebFig is available on HTTPS. Install the CA certificate on client browsers to make it trusted without a warning.

Importing an External Certificate

Upload the certificate file via Winbox Files, then:

/certificate import file-name=domain.crt passphrase=""
/certificate import file-name=domain.key passphrase=""

After import, set the certificate's name:

/certificate set [find where name~"domain"] name=my-imported-cert

Checking Certificate Status

/certificate print detail

Look at:

• invalid-before / invalid-after: validity window
• trusted: whether this cert is trusted
• fingerprint: use to verify against what your CA issued

Renewing Expiring Certificates

RouterOS doesn't auto-renew certificates. Set a reminder (or a Scheduler script) to check 30 days before expiry:

/system scheduler add name=cert-check interval=7d on-event={
  :foreach cert in=[/certificate find] do={
    :local expiry [/certificate get $cert invalid-after]
    :log info ("Certificate " . [/certificate get $cert name] . " expires " . $expiry)
  }
}

Let's Encrypt via ACME (RouterOS v7.x)

RouterOS v7 added support for ACME protocol for automatic Let's Encrypt certificate management:

/certificate acme set account-key-size=2048
/certificate acme add domain=router.example.com
/certificate acme issue domain=router.example.com

This requires the router to be publicly accessible on port 80 (HTTP-01 challenge) or DNS-01 challenge setup.

Using Certificates for VPN (IKEv2)

When configuring IKEv2 IPsec with certificate authentication instead of pre-shared keys:

/ip ipsec identity add auth-method=digital-signature certificate=webfig-cert remote-certificate=client-cert

Certificate-based VPN authentication is more secure than PSK (no shared secrets to leak) and scales better for large deployments.

Managing certificates proactively prevents the scenario where your management interface becomes unavailable because a certificate expired at midnight on a Friday.