Sorry again, but I consider the need to specify the password as argument to the command as a security issue - in this case it can be visible to people who aren’t considered trusted. Accidentally but no matter. The old behavior - ask for password if it’s missing in command’s arguments - was a good practice.
It seems I don’t understand you. Passphrase required when you’re importing password-protected certificate into RouterOS. Like when you’re importing certificate into Azure keyvault, for example. You distribute certificate as password-protected and need to use it when you export this certificate into any certificate storage.
And when I need expose the password by typing it as a argument to the command, I need to turn my head left and right to make sure no one see typed on the screen password. That’s the only problem I’m talking about. In earlier versions of RouterOS it was asking interactively without echo if no password was provided. And I’d like to see this back.
Password is necessary to successfully import a certificate which contains password protected private key, no way around it. You’re suggesting to create private key file without password protection, but for someone as paranoid as to trip over possibility that somebody sees the command line just executed, the possibility to have passwordless private key is clearly a no-no. So while you don’t seem to bother about OP’s issue, I agree with OP: ROS should prompt for password if it encounters a password protected private key and password is not passed on command line.
It’s really simple. Imagine that you have certificate with encrypted private key and you want to import it. Don’t think about why there’s password, perhaps you got it like that from someone else. It doesn’t matter. Don’t you think that RouterOS should be smart enough to ask for the password if you don’t specify it? Previous versions (v6) did.
