Today I updated a handful of cAP AC's to ROS 7.24, all bridged to the same LAN. All but one updated without incident. But one failed with the error Check for Update: ssl crl not found for mikrotik.com. If I configure the update check to ignore CRL's I can download and install the 7.24 update, but the failure repeats when I re-enable CRL's and ask whether there's anything newer than 7.24.
Why does this one cAP AC has a problem that my others don't? Using RouterOS' internal packet sniffer I sniffed the problematic router's LAN interface on port 443 during the failure. In the .pcap file I see both IPv4 and IPv6 setups with client hello and server hello to update.mikrotik.com, followed a few packets later by my router sending a fatal alert, certificate revoked. I'm wondering whether my router can't get a new CRL because it thinks the certificate under which the new CRL would be transmitted has been revoked by an earlier CRL that it's using, in effect a chicken-egg dependency loop.
Here's a link to the .pcap file that Wireshark understands. I don't think it includes any interesting private information : https://covidi.mccreight.com/~ed/mikrotik_forum/vlan_main_ssl_18aug2026.pcap I would have simply attached that file to this posting, but this forum's software doesn't seem to like .pcap attachments.
Any ideas what's going on? If it is a chicken-egg loop, how can I break it? Many thanks for your thoughts.