Certificates in DER or CER format?

RouterOS General
1

Hello, I have looking into the forums and couldn’t find an aswer. I want to enable https on webfig. I uploaded a cert and a key to my router and enabled www-ssl

Basically (once files were in place) I just did..

/certificate import file-name=cert_ge.crt
/certificate import file-name=cert.key
/ip  service enable www-ssl

The problem is that if I upload the certificate in CER format (plain text) such as:

-----BEGIN CERTIFICATE-----
MIIDFjCCAf6gAwIBAgIBAjANBgkqhkiG9w0BAQsFADB5MR8wHQYDVQQDDBZkc2ku
...
-----END CERTIFICATE-----

I can see it being imported and it appears in the certificate store, but I can’t acces to the https url for the router.

But if I use the certificate in DER format (binary), it just works.

It’s weird because I am always uploading the key in plain

-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOQ/mRBjjnZPr+Ds
....
-----END PRIVATE KEY-----

Does anyone have an explanation for this? I’d rather upload the files in CER format because it’s more convenient for me

UPDATE: Both type of certs are fine, the issue was related on not choosing the proper one for the https connection, see the post at the end for the full explanation

2

I’m able to…

Mine is plain text and opens in notepad, starts with -----BEGIN CERTIFICATE----- then a long base64. My private key is plain text too. I’m using routerOS version 6.35.2

Filename is cert.crt

In the list of certificates, mine says KAT. K signifies that a private key is associated with the certificate.

I’ve just enabled https with my cert in IP > Services and was able to connect webfig via https…

3

I finally found what was wrong, it was my fault indeed, I was enabling the www-ssl service but I didn’t specify the certifcate to use, so it used none as the cipher (don’t know if this is a bug or it’s done on purpose). It might have picked my cert somehow as it was the only one available, but didn’t show any errors or complain.

You can do:

/ip service set www-ssl disabled=no

But it will be equivalent to

/ip service set www-ssl disabled=no certificate=none

And it will end with firefox showing a message like this
(Error code: ssl_error_no_cypher_overlap)

It was fixed by setting the proper certificate value.