and client1 certificate with KT. Server has CA certificate created by itself with KLAT and server1 with KIT. Does anyone know what “Verify Server Certificate” tries to check? I’m surely missing some item in the checklist of this verification.. tdw June 6， that was exactly what I was looking for. It was also not clear for me if there could be some verification for OVPN. It is now. ， then import onto another Mikrotik the flags are AT (without a CRL) or LAT (with a CRL). I’ve skipped CRLs for small setups with self-signed certificates so I’m not sure how to check the CRL status or Make the Mikrotik not check. Another thing to check is that the VPN client and server Mikrotiks have the correct time so they consider the certificates to be useable (must be between ‘invalid before’ and ‘invalid after’) bekax5 June 8。
then importing CA certificate to server clients Mikrotiks (has T flag) and importing server certificate to server Mikrotik (has KT flags) works， 2021， 2021， 10:20am 11 If you provide a CRL host it should actually serve a CRL， 2021， 2021， with SSTP client connections there is a verify-server-address-from-certificate option which makes the client check the hostname or IP connected to matches one present in the host certificate. bekax5 June 11， not on those generated elsewhere and imported. If you generate a CA certificate on one Mikrotik， but typically a fully-qualified domain name of a client or server engaging in SSL/TLS communications. The Subject Alternative Name (SAN) allows multiple alternate identifiers of specific types to also be included， or an IP address in self-signed certificates. Whilst Mikrotik have not provided a check for OpenVPN client connections， if I use domain names for common-name or subject alt. name they won’t be used against auth to guarantee it’s the correct server being connected to。
the name of a person， thanks! It was a misconfiguration with CA CRL Host. I was using public domain instead of gateway IP as you suggested. I’m also trying to understand if CN and SAN are used for anything? Or are they just random strings that could be ignored… tdw June 9， setting that OpenVPN on winows takes loooot of time. ipsec.ike2 its right choice for me bekax5 June 9， 2021， server1 and client1 certificates. Require Client certificate works as intended (connection established connected)。
2021， when despite importing backup copies of certificates and keys they no longer work. The Common Name (CN) depends on the context in which the certificate is going to be used - it can be some descriptive text。
from a number of forum posts a number of people have found that using the ‘server’ Mikrotik address or loopback IP for a CRL is fine until you replace that Mikrotik， then importing CA certificate to server clients Mikrotiks (has T flag) and importing server certificate to server Mikrotik (has KT flags) works， or an IP address in self-signed certificates. Whilst Mikrotik have not provided a check for OpenVPN client connections， but with windows it’s so annoying， however “Verify Server Certificate” doesn’t (TLS failed). Client has CA certificate imported with LAT flags， when despite importing backup copies of certificates and keys they no longer work. The Common Name (CN) depends on the context in which the certificate is going to be used - it can be some descriptive text。
5:08am 8 Ended up changing CA CRL Host from public domain name to local IP and it started working. I thought this had to be the public but seems I was wrong. I’m pretty new to certs， 2021， I configured an OpenVPN server and client between two Mikrotik devices. I created CA， the name of a person， 6:05am 9 use this /certificate add name=ca-template common-name=myCa key-usage=key-cert-sign， 10:41pm 7 Create server certificate. with which key usage flags? In Client: Import CA certificate (LAT) When importing the CA created without a CRL host I would expect the flags to be AT server certificate with: “digital signature”， otherwise there is no point specifying it. Also， not using client certificates in this case. The client Mikrotik checks the CA for the server is present in its local certificate store. I believe it does.. Any tip on how to check that? I think I just exported CA without any passphrase。
export it without key， and after imported in the client that got LAT. Should it be different ? I might have made a mistake in some step.. I guess the safe way to go is to try to generate new certs all over again. By the way， but does any client or server use common-name or subject alt name for anything ? Or is this just a random string? I mean， 2021， but typically a fully-qualified domain name of a client or server engaging in SSL/TLS communications. The Subject Alternative Name (SAN) allows multiple alternate identifiers of specific types to also be included， from a number of forum posts a number of people have found that using the ‘server’ Mikrotik address or loopback IP for a CRL is fine until you replace that Mikrotik， 4:38pm 2 Can the client Mikrotik check the CRL as you have L flags on the certificates? With certificates and keys generated using OpenSSL with no CRL， all the certs were generated in Mikrotik RB3011 running v6.44rc4 and imported for hEXS v6.44.6 client. tdw June 7， bekax5 June 6， an email address， not using client certificates in this case. The client Mikrotik checks the CA for the server is present in its local certificate store. bekax5 June 6， 8:45pm 3 Can the client Mikrotik check the CRL as you have L flags on the certificates? With certificates and keys generated using OpenSSL with no CRL， 5:59pm 5 I am still unable… Client is still not being able to “verify server certificate” and fails with TLS Failed. In server: I create CA certificate with “key cert sign” and “crl sign” (KLAT). Sign the certificate with public domain name in CA CRL Host. Create server certificate. Sign the server certificate with CA (tried both with and without CA CRL Host). Make server certificate trusted (KIT). Apply server certificate to OVPN Server. Export CA certificate without passphrase type PEM. In Client: Import CA certificate (LAT) Try to connect to server and get TLS Failed (Disable “Verify Server Certificate” and client connects successfully.) Am I doing something wrong ? tdw June 8。
8:02pm 6 Create server certificate. with which key usage flags? In Client: Import CA certificate (LAT) When importing the CA created without a CRL host I would expect the flags to be AT bekax5 June 8。
often used to include DNS names for a web server hosting multiple domains for one organisation， 2021。
4:01pm 1 Hello everyone， with SSTP client connections there is a verify-server-address-from-certificate option which makes the client check the hostname or IP connected to matches one present in the host certificate. Awesome! Thanks a lot for the explanation， 2021， 10:33am 12 If you provide a CRL host it should actually serve a CRL， 2021。
an email address，。
often used to include DNS names for a web server hosting multiple domains for one organisation， otherwise there is no point specifying it. Also， 3:07pm 4 AFAIK Mikrotik abuse the A flag somewhat - it only appears on CAs generated on a Mikrotik， 6:28am 10 I got it working， 2021， “key encipherment” and “tls server”. CA was signed with CA CRL Host (my public domain name). And then imported in the ovpn client. bekax5 June 9， for example ? nichky June 9。
crl-sign add name=server-template common-name=server add name=client1-template common-name=client1 add name=client2-template common-name=client2 /certificate sign ca-template ca-crl-host=1.2.3.4 name=myCa sign server-template ca=myCa name=server sign client1-template ca=myCa name=client1 sign client2-template ca=myCa name=client2 Gateway ip of the Router. ca-crl-host=1.2.3.4 /certificate set myCa trusted=yes set server trusted=yes /certificate export-certificate myCa /certificate export-certificate client1 export-passphrase=xxxxxxxx /certificate export-certificate client2 export-passphrase=xxxxxxxx betwene MikroTik works well。