This has just happened: doh server connection error network is unreachable over DNS 1.1.1.1 - #38 by edyatl
Not long ago I had to import SSL.com Root Certification Authority ECC in order to get Cloudflare DoH working again. I kept getting this in log: DoH server connection error: SSL: ssl: no trusted CA certificate found (6)
After upgrading my setup to 7.21, I did notice that my CCR2116 is getting looped packet alerts.
I have two switches (also on 7.21) in a MLAG config, S1 and S2 is both connected to the CCR2116.
Also haven't troubleshooted it yet, but a few VLANS were messed up as devices weren't able to communicate with the default gateway while connected to my livingroom-AP. (Worked properly with office-AP, both are cAP AX's)
Downgrading to 7.20.6 on CCR2116, switches, and APs fixed both of these issues.
Hi,
Try to disable and enable bride port and/or bride vlan entries to see if l2 start working like expected.
It's not persistent after reboot.
I've same behavior..
Very strange
Is there a reason Mikrotik does not include all the common root certificate authorities in the built-in CA? It would be quite helpful in situations like this
It's the size. The flash usage on my 16MB devices was reduced by almost 1 MB when I removed the CA-Cert list from Mozilla/CCADb from them after the built-in CA list was introduced. The size of the .backup file was also reduced by 500KB. That list has over 140 certificates.
The RouterOS built-in list in 7.21 only has 25 certificates. It's a tradeoff for the 16MB devices.
It would be nice if they could include the rest of the certificate authorities as an extra package for devices with enough storage. I know you could use a script to manage certificates but then they wouldn't be “built-in”
Agreed! But also, the update of the list should be decoupled from the RouterOS updates, like it's the case for other operating systems. We can see on this forum that because newer RouterOS versions often have bugs/breaking changes, people will stay on year-old "more stable" versions. The current implementation would mean those devices will have out of date built-in CA list.
The built-in CA could be provided as version-less .npk packages (maybe one "minimal" and one "full" package) that can be independently updated, not embedded in routeros.npk to avoid doubling the storage usage after update.
Will I need to reconfigure my router when upgrading from v7.20.6 to v7.21?
Depends.
Normally not. But it you use features which have been subject to changes in between (or bugs) it might be needed to do something.
From that perspective, it makes no sense for the CA certificates to be integrated into the RouterOS bundle. It should generally be provided as a separate package that can be updated independently and is not tied to a specific RouterOS version, possibly with a minimum-version dependency.
WiFi interfaces wifi1, wifi2 stopped working in bridge: port is already slave. It is default config and bridge br. Other WiFi interfaces on other bridges work without issue
Without further detail on what device you have this problem on nor which version it came from, this is not really useful info.
The issue concerns only routers with LTE WAN interface.
With FTTH, there's no problem.
Considering this is always obtainable online, couldn't this type of certificates be placed in a tmpfs /certificates , or something like that?
But they have to be sourced from somewhere (i.e the routeros package), so they still need to be in flash.
After installing 7.21 I saw that it creates an disabled ovpn-server interface.
I installed 7.21 also on an different device an there it didn’t create and ovpn-server interface.
It happens when you upgrade from < 7.17.
I've create a support ticket about fews problems related bridges/interfaces, i think we should forget this 7.21 and wait the 7.21.1 version
Support said 7.20.8 will be released to so problem is identified in boths branchs 7.20, 21 and 22...
L41G-2axD&FG621-EA
No bridge hardware offload for ethernet ports after upgrade 7.20.7 → 7.21 (defconf). OK after downgrade.
