Hi forum,
I try to setup in internal CA, but the client’s and openssl/curl can’t verify it.
OpenSSL always reports the error that the root certificate is not valid for the purpose(And the sub ca also).
Here what I have done:
/certificate add name="Root CA" common-name="Root CA" trusted=yes digest-algorithm=sha512 organization="Foo" days-valid=7305 key-size=secp521r1 key-usage=key-cert-sign,crl-sign,ocsp-sign,digital-signature
/certificate sign "Root CA"
/certificate add name="Sub CA" common-name="Sub CA" digest-algorithm=sha512 organization="Foo" days-valid=3650 key-size=secp521r1 key-usage=crl-sign,key-cert-sign,ocsp-sign,digital-signature
/certificate sign "Sub CA" ca="Root CA"
/certificate/add name=Device days-valid=365 key-size=secp521r1 key-usage=tls-server common-name="hostname" subject-alt-name="DNS:hostname" organization="Foo"
/certificate sign "Device" ca="Sub CA"
/ip service set www-ssl certificate=Device
And here how I verify it:
openssl s_client -connect hostname:443 -showcerts -CAfile /tmp/x.txt
/tmp/x.txt will contains the root ca.
But it fails with:
CONNECTED(00000003)
depth=1 O=Foo, CN=Sub CA
verify error:num=26:unsuitable certificate purpose
verify return:1
depth=2 O=Foo, CN=Root CA
verify error:num=26:unsuitable certificate purpose
verify return:1
depth=2 O=Foo, CN=Root CA
verify return:1
depth=1 O=Foo, CN=Sub CA
verify return:1
depth=0 O=Foo, CN=hostname
verify return:1
The generated certs in detail:
/certificate print detail
Flags: K - private-key; L - crl; C - smart-card-key; A - authority; I - issued, R - revoked; E - expired; T - trusted
0 K A T name="Root CA" digest-algorithm=sha512 trusted=yes common-name="Root CA" organization="Foo" subject-alt-name="" key-type=ec key-size=secp521r1
key-usage=digital-signature,key-cert-sign,crl-sign,ocsp-sign days-valid=4482 invalid-before=2025-10-10 15:35:15 invalid-after=2038-01-18 05:14:07
serial-number="691B396BB0711DD5" akid="" skid=9B6746EFD9953AEBA7366A2993FC47C28CC43C21
fingerprint="3df31e72e55ce39ffff92e53dda2fa226f815f6d9a1d2da9704915fa92983ba4" expires-after=640w2d13h25m47s1 K A name="Sub CA" digest-algorithm=sha512 trusted=no common-name="Sub CA" organization="Foo" subject-alt-name="" key-type=ec key-size=secp521r1
key-usage=digital-signature,key-cert-sign,crl-sign,ocsp-sign days-valid=3650 invalid-before=2025-10-10 15:36:02 invalid-after=2035-10-08 15:36:02
serial-number="28208D05D151C03E" akid=9B6746EFD9953AEBA7366A2993FC47C28CC43C21 skid=DD95BA4B479CAB2D9A9A5AA8E86AD2DDA7059E9D ca=Root CA
fingerprint="77428a0a5b801edc862f025bb37636de90ff8ae1dd3c48f0ce0e31672a4d38d6" expires-after=521w2d23h47m42s2 K I name="Device" digest-algorithm=sha256 trusted=no common-name="hostname" organization="Foo" subject-alt-name=DNS:hostname key-type=ec key-size=secp521r1
key-usage=tls-server days-valid=365 invalid-before=2025-10-10 15:36:28 invalid-after=2026-10-10 15:36:28 serial-number="5C6917A157A331FA"
akid=DD95BA4B479CAB2D9A9A5AA8E86AD2DDA7059E9D skid=664407B3BB071EF3494BC887D5E5A9546854D917 ca=Sub CA
fingerprint="bfa9de90db3145c26c82cb49912c9a58e7dd296dbdabc30ea5493bc9e5ecee95" expires-after=52w23h48m8s
Reading the browser cap documentation there will be written for the key usage of an ca on page 133:
digitalSignature, keyCertSign and cRLSign are required minimum.
The official documentation for RouterOS is very strange, because here are settings in use, which are incorrect in view of certificate usage. For example the key usage in the Client + Server sample. For an server/client key/crl signing is forbidden. And tls-server for an client is also very strange.
So what goes wrong?