Hi, I’m using a RB2011uias and I need to configure the IPsec VPN.
I managed to do that following the guides in the wiki but I’m having problems with the revoked certificates.
I have checked previous questions like http://forum.mikrotik.com/t/revoked-certificates-contunue-to-work/89293/1 and http://forum.mikrotik.com/t/revoked-certificate-still-work/117730/1
My idea is the router to be the: CA, VPN server and CLR server.
As now I have done this:
/certificate
add name=ca-mkr common-name=ca-mkr key-usage=key-cert-sign,crl-sign
add name=server-mkr common-name=server-mkr subject-alt-name=DNS:XXXX.XXXX.XXXX key-usage=tls-server
add name=client1 common-name=client1 key-usage=tls-client
sign ca-mkr ca-crl-host=127.0.0.1 name=ca-mkr
sign server-mkr ca=ca-mkr
sign client1 ca=ca-mkr
/ip ipsec identity
add auth-method=digital-signature certificate=server-mkr generate-policy=\
port-strict match-by=certificate mode-config=ike2-conf peer=ike2 \
policy-template-group=ike2-policies remote-certificate=client1
/ip firewall filter
add action=accept chain=input comment="CA crl-host www port80" protocol=tcp \
src-address=127.0.0.1 src-port=80
However, I tried revoking the client1 certificate but a remote client using that cert in an Android StrongSwan app, continues to access the VPN with no problems.
Also, I dont understand how the CRL works. The CA need to access it to update the revoked? The remote client need to access it to check if his current cert is not revoked?
Can someone enlighten me?
Thanks
EDIT:
www service is also enabled:
Flags: X - disabled, I - invalid
# NAME PORT ADDRESS CERTIFICATE
0 XI telnet 23
1 XI ftp 21
2 www 80 127.0.0.0/24
3 ssh 2200 192.168.0.0/24
4 XI www-ssl 443 none
5 XI api 8728
6 winbox 8291 192.168.0.0/24
7 XI api-ssl 8729 none