Ok, been doing some more research and testing of older RouterOS versions.
RouterOS was seemingly not able to make/issue certificates before around version 6.10.
The checkbox that was labeled "CA" seem to have just been "Trust" before it was renamed in version 6.3.
I have attempted to import my CA on multiple different RouterOS versions with the same result. On version 6.10 it at least was able to see "Digital Signature" as a key usage, whereas on 6.35 it shows as having a blank list of key usages (as seen in the picture I posted before).
I created a new CA using OpenSSL on a linux machine (following http://wiki.mikrotik.com/wiki/Manual:Cr ... th_OpenSSL
) and have had it act identical to my CA. So I figure I can rule out that it is my CA that is the problem.
I don't know how RouterOS makes the certificates, but a MikroTik router is able to use CAs created on another MikroTik router just fine.
I wish my FTP was FTL.