you could add to Hotspot HTTPS by default, so that it is compatible with all websites https by default, and eliminate once the http
from my point of view this would be possible if you might give in Routerboards a signed certificate with a domain to you predefined eg https://hotspot.mikrotik.com
that would be great, because the hotspot is falling into disuse because many of the sites are https, and almost nobody buys a signed certificate only to implement it
Having a pre-signed certificate defeats the point of certificates.
The purpose of a certificate (when implemented correctly) is to tell you that the owner of the web server you’re visiting is also the owner of the domain, as opposed to a device intercepting the domain, and using it for its own web server.
If the certificate is signed to hotspot.mikrotik.com, and you get that certificate on your device, this means your router can pose as “the” web server for that certificate… As can your competitor who also bought a MikroTik device, or the script kiddie next door.
It is easy, but you need some money.
*You have to create a private key in a Linux system.
*Create a CSR for one of domains you control. Buy one for some €. This domain will be used by all your hotspots.
*The CA send you the Signed Certificate.
*UPload the private key, the signed certificate and the CA certificate to all your hotspot.
Note: all your hotspots will have the same domain, but it is the same because the DNS is local.
You realize, that even with https hotspot and valid certificate, you’ll still have problems with users who have https://someserver.tld set as their homepage, right?
Sob, please understand that what you’re asking for can not be universally implemented, because HTTPS is designed to protect end-users from just that kind of things (man-in-the middle doing something, the original web-server does not intend to do- redirecting your users to some hotspot page, for instance).
It may be a breach yes, but will again be compatible with all websites
Plus it can be circumvented if warned that the certificate with the domain that is in it is only for testing purposes and should not be used in production,
more like a small house that would work, and hotspot again be used more
Lets make it clear, what exactly do you mean by “will again be compatible with all websites”?
If you are after free certificate for your hotspot, wait a little while for Let’s Encrypt. It’s supposed to be free (zero cost) and automated. And probably also with short validity period, so the automation will be more or less necessary for convenient use. You might do it yourself using some external script. But you can also try to convince MikroTik to add client as part of RouterOS. That way the https secured hotpot with valid certificate could be a matter of one click.