I have a single FQDN certificate working (though it hasn't yet reached its first automatic renewal, so working*) on a RouterOS 7.20something (current) system.
As far as I'm aware, RouterOS (as of 7.23.x) ACME still does not support Wildcard certificates - correct?
Question: Does RouterOS (7.stable) ACME support multi-SAN certificates? That is, one certificate, one ACME subscription (key, etc) but the delivered certificate will work for more than one FQDN?
thanks,
-Jay
It does. The domains must of course all point to your router, as HTTP-01 is used. Here is the doc:
Certificates | RouterOS Manual
Notice that the parameter is named domain-names (plural) and accepts a comma-separated list of domain names. The domains will populate the Subject Alt. Names list, Common Name is set to the first domain.
DNS-01 is only used for the IP cloud domain, so wildcard certificates are not yet supported. I've submitted an idea for an implementation some time ago that should be do-able V7.22beta [development] is released! - #56 by CGGXANNX as feature request.
Thank you @CGGXANNX (By the way, I'd been meaning to ask; what's the story behind your handle CGGXANNX ?).
I wonder why my search didn't come up with that page :-/ (I searched for RouterOS ACME multi-SAN). sigh
Hm. I assume that "The domains must all point to your router" means that only one single MikroTik must be the resting place for all of the SANs in the one multi-SAN certificate; I'd been hoping to buy one multi-SAN cert to use across a small handful of different MikroTik routers.
On the other hand, if I recall correctly, ACME certificates do not use revocation, and if Router1 obtains Cert1 (containing multiple SANs) using a single ACME keypair, and then shortly thereafter Router2 obtains Cert2 using the same keypair, both instances of the certificate would remain valid for the issued lifespan?
(I'm not trying to cheat the CA; just looking for the most efficient valid method that doesn't require me to use off-RouterOS-box, or on-RouterOS-container additional scripting solutions; it's all quite complicated enough already, and I don't need to add more moving parts!)
thank you,
-Jay