I'm trying to import a PKCS#12 (aka p12) file with a certificate for the router, along with it's corresponding private key, one for the intermediate CA and ohe for the root CA. As such, the p12 file contains a total of 3 certificates and one private key.
Up to some past version, ROS would add a counter to the end of a "friendly name" that was passed on the import command, such as:
/certificate import name=mycert file-name=certs.p12 passphrase=whatever
would end up importing the 3 certificates with friendly names mycert, mycert_1 and mycert_2 for the 3 certificates, being the "mycert" the one associated with the private key and to be selected for use by the router.
However on recent version I'm getting all 3 certificates with the same "friendly name" "mycert". Not only it makes it impossible to programmatically select the proper certificate for the router but also hard to remove.
Am I missing something here?? Is this a bug or an intentional change?
Thanks in advance!
I'm also not sure whether it's a bug or a feature but can't the "friendly names" be changed through the /certificate menu?
/certificate set name=whatever
While it's true that certificates "friendly name" can be changed, in this case selecting the target for the name change is the challenge. Using WebFig or WinBox is another story as it's visually easy to identify. But I need it for a script (that install Let's Encrypt certificates on a few routers). So renaming is not practical approach.
There is a workaround that uses the P12 just for the certificarte+key and use 2 PEM files for the chain and CA. 3 file to transfer and 3 imports. Not the most clever way but...
I'm more curious why it's not adding the incremental suffix as before. It worked for a few years. If it's a bug...
If it's for a script, you can use unique features of the certificate like the private-key flag and insert them into a [ find ] matcher
Indeed one can use find to get the id of the certificate to change the friendly name, but it has it's limitations and challenges (such as having multiple certificates that matches the find argument). One possibility is to use the certificate fingerprint.
Interesting is that the documentation at https://manual.mikrotik.com/docs/authentication-authorization-accounting/certificates still mentions that the "_number" suffix is used. If I recall correctly there was a release of ROS that make changes to the certificate import code.