There is a defect in 7.9 related to certificates. Most possibly due to the “*) ipsec - refactor X.509 implementation;”
In my setup, I have ROS 7.8 connected to ROS 6.49.6 via IKE2:
auth: digital signature
My Type ID: auto
remote type ID: auto
Match by: remote id
(the same config on both sides)
The setup worked well until I upgrade the 7.8 to 7.9. After the upgrade:
ROS 6.49.6 floods with: got fatal error: AUTHENTICATION_FAILED
ROS 7.9 floods with: can’t verify peer’s certificate from store
Immediately re-checked the certificates: found them valid on both sides.
How to fix?
Regards.
Update: re-checked all other combinations of my ID/remote ID on both sides - nothing works. Again re-checked certificates on both sides - all certificates are correct and valid including CA (the same CA was used to issue end-point certs. It actually looks like a defect in ROS7.9 - it worked perfectly until the v7.9
BTW, is there a way to roll-back to the previous version?
Manually download v7.8 from download archive … make sure you get all the package files, consult the list of currently installed packages under /system/packages .
Place those npk files to whatever root storage on device (so they are seen in /file/print in root space and not in some subdirectory).
Execute /system/package/downgrade
At this point router will reboot (possibly prompting you for consent) and after it comes back, it should be running ROS v7.8.
Also, when you have a router that allows it (sufficient storage), always make 2 partitions and copy your running partition to the other one before the upgrade.
Then, whenever an upgrade is not what you like it to be, you can just activate the other partition and reboot, and you are back to exactly what you had before.
(and you still have the upgraded version at hand in case you later want to do some more tests)
Of course this is not possible on devices with 16MB flash.
It may not be possible also with devices with larger flash, but that depends on size of necessary packages and disk space required for running ROS. E.g. Audience with 128MB flash can not be partitioned, packages get downloaded onto flash disk (not RAM disk), but wifiwave2 package is huge … everything doesn’t fit in 64MB partition.
In recent versions you can have a user-defined RAMdisk. But I do not know if you can upgrade from packages stored there.
And of course it would not work with the built-in upgrade commands, as I don’t think you can set the download location, it is always .download in the root.
(well, maybe you could define a RAMdisk named .download)
Fortunately, the affected ROS instance was CHR, I restored it from backup.
I set up a separate CHR instance with ROS 7.9 configured it from scratch and re-tested the issue. So yes, the described behavior was reproduced. IPsec between ROS 6.49.[6,7] and ROS 7.9 with IKE2/certs doesn’t work. Considering the defect confirmed.
2Mikrotik staff: is it actually as expected? Don’t you need to fix it urgently?
I have this problem with ProtonVPN. It worked before on 7.8 but not after upgrade to 7.9 on a hAP AX2. Now something has changed, but it looks to me like I need to have the whole certificate chain:
Just curious:
Was that response via support ticket or in public discussion(Redit & etc)?
I extracted Intermediate CA certificate from IPsec ISAKMP phase (IPsec debug output from RouterOS + Wireshark )
Here is certificate in DER and PEM encoding: ProtonVPN_IKE_Intermediate_CA_1.tar (6 KB)
Right now I don’t have time to conduct a test, so maybe one of the users will have time to do it before I get my hands on it myself
P.S.
It should be borne in mind that if this works, then this is only a temporary solution, since:
The intermediate certificate can be replaced at any time by ProtonVPN
It is necessary to ensure that the problem of certificate chain verification is solved.
Сlient DOES NOT HAVE to have the entire chain of certificates on its side in order to build correct certificate chain.
Client only needs to have a root certificate to verify entire chain, provided that the server provides all intermediate certificates.
Import of certificates is not(and never was) a problem, but is how RouterOS validate certificate chain.
Previously, validation worked correctly: if there is a root certificate in system store, and the server to which the connection takes place transmits an intermediate certificate, then the certificate chain was correctly validated.
After version 7.9, this logic was broken, and now it is required to import not only root certificates into the system store, but also ALL intermediate ones.
PKI should not work that way.
)
