Let's Encrypt UPPER case issue

RouterOS General
1

I use Let's Encrypt certificates on my MikroTik Routers, and setup a script for auto-renew certificates.
It works fine for a long time(years).

At the begin of June 2024, I found some of my MT devices didn't renew its certificates.
When I try to renew certificates manually, it shows some error message (as below).

==================================================
enable-ssl-certificate dns-name=RB4XXX.example.com
progress: [error] Invalid identifiers requested :: Cannot issue for "RB4XXX.example.com": Domain name contains an invalid character, type: urn:ietf:params:acme:error:rejectedIdentifier, code: 400

I found that Let's Encrypt don't accept UPPER case domain name since June 2024.

Is it possible for MikroTik to automatic change "enable-ssl-certificate dns-name=" to lowercase ?

Thank you.

2

Maybe you can use a script/function:
http://forum.mikrotik.com/t/i-did-it-script-to-compute-unix-time/68576/18

3

I just happen to never use uppercase names, so I guess I never noticed. And LE IMO shouldn’t force this - DNS names should be case-insensitive per RFCs.

Perhaps RouterOS should do that internally… since it might not someone first thought as to the issue. I’d imagine there are at least some folks who use some /system/identity to build the dns-names= for LE, like:

dns-names="$[/system/identity/get name].example.com"

and, depending on naming scheme, an uppercase things in device name is possible.

But in latest version, there is a :convert transform=lc option (lc = lowercase) to do this so you can “protect” the dns-name= from uppercase using

/certificate/enable-ssl-certificate dns-name=[:convert transform=lc HOST.EXAMPLE.COM]
4

Sorry I don’t understand. Why don’t you just write it lowercase, just like everywhere on the internet?

5

Because he wants to name his routers properly … and proper personal names are with capital initial (e.g. Normis, not normis). And he now needs some kind of work around the LE requirement.

6

First, thanks for accept my advice.
I found this function appeared in changelog.

*) certificate - automatically parse uppercase symbols to lowercase when registering domain on Let’s Encrypt;

A late explain to “Why don’t you just write it lowercase” :

  1. I managed more then 1500 MT routers.
  2. each of them has own identity like “Dorm-C-801”
  3. I would like all of them worked with correct LetsEncrypt Cert, and of course update every 3 month.
  4. so I write a scheduled script as following:
/ip service set www disabled=no
/certificate
enable-ssl-certificate dns-name=([/system identity get name].".example.org")
remove [find name!=[/ip service get www-ssl certificate]]
/ip service set www disabled=yes
  1. config for each router are the same. (use CAPsMAN to modify identity, and DHCP for ip addresses) so don’t want to change script for each router.
  2. I use
<img src=https://Dorm-C-801.example.org/graphs/iface/ether1/daily.gif>

to show a lot of graph at a time, that’s why I need LetsEncrypt Cert for each router.

P.S: I think built-in function lowercase also solved this problem, too :slight_smile:

7

Please don’t take Normis too seriously. He is known for initially dismissing issues when he doesn’t immediately see the problem. Your use case is perfectly valid. Why shouldn’t one be allowed to use capital letters in a hostname? Sometimes, the reasoning from Mikrotik can be a bit puzzling. In the end, they did recognize the issue, realized it wasn’t due to user error, and fixed it. That’s just how things work here.