How many SSL's for 8 MT's, 1 Website, 1 AAA/RADIUS???

RouterOS General
1

I am setting up 8 Mikrotik RB411U’s with Hotspot pkg, and a Website for redirects and a AAA/RADIUS server for a limousine company.

GoDaddy has a ‘Standard (Turbo) SSL (1 Year) (annual)’ for only $12.99

Am I correct in assuming that I would only need 3 Standard SSL certificates?

I am assuming that if the Mikrotiks hotspot domain is the same on all 8 mikrotiks, a single cert can be put on all 8, correct?

I am assuming that the AAA Radius needs its own cert to work with Paypal payment Solution, correct?

I am assuming that the Website will need its own cert to work with Transitions of Local to Remote web components, Correct?

Thanks, for any information that can help me verify this information. I am open to other solutions for securing content and payment transactions.

2

Maybe I have asked my questions improperly, so allow me to rephrase.

How do I avoid having to buy 1 certificate per mikrotik when running Hotspot?

To avoid the “unverified or invalid” certificate message, is there a post explaining or a wiki that discusses this?

Am I incorrect in using a certificate on a RADIUS/AAA server to keep username password and authentications secure?

I could use a hand, as these are my weak points when it comes to the Hotspot on mikrotik ROS and my ability to search is returning content from 2006 or 2.9.x ros features.

Thank You.

3

You need certificate for all routers as long as you use the same hostname on all of them for the Hotspot.

This is relatively easily done by either using the same IP space on every Hotspot network, or by using a loopback address (create a bridge, add no ports to it, and assign it an IP address) and implementing the same loopback on every Hotspot router.

For example, make a loopback on every router that runs Hotspots for you and assign it 10.1.1.1/32. Then map 10.1.1.1 to hotspot.example.com on all DNS servers that are relevant (probably a static DNS entry on the routers themselves, and also on the DNS server for your domain). Set the domain-name on all Hotspot server profiles to hotspot.example.com, set the IP address to 10.1.1.1, and buy a certificate for hotspot.example.com.

You do need a certificate for any external servers you use, as usual.

You do not need a certificate for RADIUS. RADIUS uses its own encryption mechanisms, and does not utilize SSL (and couldn’t - RADIUS uses single UDP packets that aren’t part of a negotiated session, so SSL/TLS wouldn’t work for that). If you need very strong encryption build VPN tunnels (such as IPsec) between sites and run RADIUS via the VPN.

Hope that helps.

4

Thanks for the response fewi

I will use 1 for all mikrotiks using the same hotspot dns name.
I will use 1 for the website (for the devices with Remote login page)
I will use 1 for the RADIUS/AAA as it has User Account self Care on it.

your karma point was awarded, and thank you again.