Genieacs + Letsencrypt Cert = Handshake error on Mikrotik TR069?

antleo · September 21, 2020, 2:55pm

I am running GenieACS with a Lets-Encrypt cert thinking that the Mikrotik router would be able to pull any necessary CA and CRL down from the web. However every time I try to connect I get

SSL: handshake failed: unable to get local issuer certificate (6)

. How can I rectify this?

MickeyT · September 23, 2020, 4:59am

When I first loaded a Let’s Encrypt certificate in to a MikroTik (CCR1009-8G-1S) I kept getting the following message in the log:

got CRL with bad signature, issued by :DST Root CA X3::Digital Signature Trust Co.:::

I don’t know if this relates to your problem (I’ve never used GenieACS) but the fix for the error is to download the root certificate and import it in to the MikroTik

Download the DST Root CA X3 certificate from https://www.identrust.com/support/downloads.
Scroll to the section labeled TrustID X3 and click on the link for the Base64 Root Certificate (https://www.identrust.com/dst-root-ca-x3).
Save the certificate to a text file and upload it to the MikroTik.
Import the certificate (it is automatically trusted).

/certificate import file-name=X3cert.crt

Hopefully this will help fix your problem (or at least give you somewhere to start).

antleo · September 23, 2020, 12:26pm

When I first loaded a Let’s Encrypt certificate in to a MikroTik (CCR1009-8G-1S) I kept getting the following message in the log:
got CRL with bad signature, issued by :DST Root CA X3::Digital Signature Trust Co.:::
I don’t know if this relates to your problem (I’ve never used GenieACS) but the fix for the error is to download the root certificate and import it in to the MikroTik

Download the DST Root CA X3 certificate from https://www.identrust.com/support/downloads.

Scroll to the section labeled TrustID X3 and click on the link for the Base64 Root Certificate (https://www.identrust.com/dst-root-ca-x3).

Save the certificate to a text file and upload it to the MikroTik.

Import the certificate (it is automatically trusted).
/certificate import file-name=X3cert.crt
Hopefully this will help fix your problem (or at least give you somewhere to start).

That looks like exactly my problem, Thank you!!!

For anyone reading this in the future: This did work perfectly.

blingblouw · March 4, 2021, 10:02am

Same boat here.

After importing the certificate I see its valid until Sep/30/2021 16:01:15

What happens after that date, a new certificate is issued?

sindy · March 4, 2021, 10:51am

Yes, the idea of Let’s Encrypt is that the certificate is short-lived, and quite a long time before its expiry, the certificate holder applies for a new one, gets verified again, and a new certificate gets signed. All this is automatic on Linux, but support for this automation doesn’t seem to be implemented in RouterOS yet.