Built in Root Certificate Authorities lacks CA used by cloudflare-dns.com

RouterOS General
1

I’m guessing my local POP for cloudflare-dns.com had just updated their SSL cert to the one issued by SSL.com, because my DNS resolution suddenly stopped at 2026-01-15 21:42:52 UTC+0 with plenty of the following error flooding my ROS log:

DoH server connection error: SSL: ssl: no trusted CA certificate found (6)

I don’t have historical info on what the previous CA was, but for now I can see it’s using one that isn’t in the ROS 7.20.4.

Subject: /C=US/ST=Texas/L=Houston/O=SSL Corporation/CN=SSL.com Root Certification Authority ECC
Serial Number: 75E6DFCBC1685BA8
SHA-1 Fingerprint: C3:19:7C:39:24:E6:54:AF:1B:C4:AB:20:95:7A:E2:C3:0E:13:02:6A

I got rid of the error after importing the CA into ROS as trusted, I thought I’d share here in case anyone else is affected by this.

It’d be nice if this CA can be included in ROS as well.

2

It took me a while to figure that out too. FYI the download URL is here:
https://ssl.com/repo/certs/SSLcomRootCertificationAuthorityECC.pem

3

yeah, hit me also
it was hard to debug since for me it affects forwarders and logs doesn’t contain dns host name

4

I have the same case today.

Just added “SSL.com SSL Intermediate CA ECC R2” from cloudflare-dns.com .

And I agree with:

5

Painful discovery on my routers too.
Issue started yesterday 22H42 GMT+1

Thanks for the link to add the missing CA @alibloke

6

If you don't want to manually add the CA cert, and want to wait for the update from MikroTik, you can change the DoH URL to https://mozilla.cloudflare-dns.com/dns-query. It's still Cloudflare, but with better privacy/less data collection. It's the URL used by Firefox when you select Cloudflare as DoH provider in the browser.

https://developers.cloudflare.com/1.1.1.1/privacy/cloudflare-resolver-firefox/#what-information-does-the-cloudflare-resolver-for-firefox-collect

This URL still uses a certificate with GlobalSign Root CA as CA and the cert is still valid until April 7th (it was renewed last week).

7

Thanks! Yesterday the issue with DoH also started on my RB5009. When this happens, the router completely loses the ability to resolve DNS, even after disabling DoH and rebooting, the problem persists. It’s quite strange.

8

I tried switching DoH to https://mozilla.cloudflare-dns.com/dns-query, but unfortunately it didn’t resolve the issue for me. I had DigiCert Global Root G2 installed.

Steps that actually solved it for me:



/ip dns set verify-doh-cert=no
/ip dns set servers=1.1.1.1

/tool fetch url="https://ssl.com/repo/certs/SSLcomRootCertificationAuthorityECC.pem" 

/certificate import file-name=SSLcomRootCertificationAuthorityECC.pem

/ip dns set verify-doh-cert=yes
/ip dns set servers=""

/ip dns print
9

Thanks

10

Well, that’s an unfortunate incident.

The builtin CA certificates list that was introduced just a few weeks ago was supposed to prevent this sort of problems and save the user from installing and maintaining the certificate list itself, I guess I’m back installing my own list.

You should do your own research and don’t trust me or any other random person, but I’ll share what I’m doing just in case anyone is wondering:

  1. Go to mkcert.org and read what’s there
  2. curl https://mkcert.org/generate/ -o RootCAcert.pem
  3. Upload the pem file, under Files in RouterOS
  4. Import the file under System → Certificates
  5. Re-enable Verify DoH Certificate under IP → DNS

It would be a good idea to re-import the list regularly in case of any CA gets removed from the trust list or the certificate gets close to expiring.

11

This is the best idea till Mikrotik update the internal list!

12

Happened to me too. Was wondering what happened. Family accused me of ‘breaking the internet ‘

13

Don’t forget if your using static entries change to

mozilla.cloudflare-dns.com
14

Only accused?

I thought you were also judged and found guilty. :wink:

https://www.imdb.com/it/title/tt0079470/quotes/?item=qt0471984&ref_=ext_shr_lnk

15

How the Family saw you:
https://www.youtube.com/watch?v=v_YozYt8l-g

16

All of the above…… I think the call was…..’Stone him…’ and ‘why can't we have normal internet like everybody else….?’

The power to control the household internet is mightier than the sword

17

Strange. I have imported the CA cert from SSL.com

But the console said import : 0

This is the link where i got it from : https://ssl.com/repo/certs/SSLcomRootCertificationAuthorityECC.pem

18

I saw fetched: 0 message as well. As I understand it, this is because the SSL.com ECC CA file is very small/lightweight. The file is fetched correctly (it shows up in /file print), and the import actually succeeds. After that, DoH certificate verification started working normally for me. Try /file print to list the file.

19

I have the same issue. I see DoH server connection error I don't know if it's related with update 7.21 because I see there are some changed related to certificates in the changelog.
With regards,

20

The timing is very close for both events. MikroTik released RouterOS 7.21 stable on January 12, 2026, and Cloudflare’s DoH TLS certificate chain changed shortly after, most likely around January 14, with failures noticed by January 15.

Since both happened almost at the same time, either could be a contributing factor. In any case, it definitely makes sense to check and refresh the CA certificates on the router.