Making Imported Certificate into a Certificate Authority

RouterOS General
11

Thx @luca1234567 for your thread http://forum.mikrotik.com/t/correction-request-authority-flag-for-import-ca-certificate-autority-in-routeros/137960/1

I just added the KeyCertSign, CrlSign flags and the nsComment in my CAs certificat request,
and it works like a charm!

I mean my CAs is interpreted by RouterOs as a CA certificate. :white_check_mark:

In C#

var request = new CertificateRequest(
    issuer,
    rsa,
    HashAlgorithmName.SHA256,
    RSASignaturePadding.Pkcs1
);

request.CertificateExtensions.Add(
    new X509BasicConstraintsExtension(
       certificateAuthority: true,
       hasPathLengthConstraint: true,
       pathLengthConstraint: 0,
       critical: true
   )
);

// Adding the KeyCertSign and CrlSign flags
request.CertificateExtensions.Add(
    new X509KeyUsageExtension(
        X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign,
        critical: true
    )
);

// Adding the nsComment "Generated by RouterOS"
var nsCommentAsBytes = System.Text.Encoding.ASCII.GetBytes("Generated by RouterOS");
var nsCommentExtension = new X509Extension("2.16.840.1.113730.1.13", nsCommentAsBytes, false);
request.CertificateExtensions.Add(nsCommentExtension);

Thanks all for your time, you made my day!