Community discussions

MikroTik App
  4. RouterOS
  5. General

can't import 2 cert and key

Post Reply
 
d3st1ny
just joined
Topic Author
Posts: 8
Joined: Thu May 30, 2013 4:23 pm

can't import 2 cert and key

Thu Aug 10, 2017 12:35 am

Hello again. Brand new RB3011 with RoS 6.40.1. For l2tp+ipsec I want to import two certificates, one for remote server and one for mikrotik itself. But something going wrong.
this is my certs and keys
Code: Select all
admin@MikroTik] /file> print
 # NAME                                                                                                         TYPE                                                                                                              SIZE CREATION-TIME       
 0 skins                                                                                                        directory                                                                                                              jan/01/1970 03:00:05
 1 pub                                                                                                          directory                                                                                                              jan/01/2002 05:11:47
 2 gw.comp.com.key                                                                                   .key file                                                                                                               3243 aug/09/2017 23:58:30
 3 city.crt                                                                                                     .crt file                                                                                                                 1927 aug/09/2017 23:58:30
 4 city.key                                                                                                    .key file                                                                                                               3243 aug/09/2017 23:58:30
 5 gw.comp.com.crt                                                                                     .crt file                                                                                                                 1919 aug/09/2017 23:58:30
Then go to certificate:
Code: Select all
[tirey@MikroTik] /certificate> print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                                           COMMON-NAME                                          SUBJECT-ALT-NAME                                                                                                             
[admin@MikroTik] /certificate>
There is nothing. Now import first cert and key
Code: Select all
[admin@MikroTik] /certificate> import file-name=city.crt          
passphrase: 
     certificates-imported: 1
     private-keys-imported: 0
      files-imported: 1
      decryption-failures: 0
  keys-with-no-certificate: 0
[admin@MikroTik] /certificate> import file-name=city.key 
passphrase: 
     certificates-imported: 0
     private-keys-imported: 1
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0
[admin@MikroTik] /certificate> print 
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                                           COMMON-NAME                                          SUBJECT-ALT-NAME                                                                                                           
 0 K      T city.crt_0                                     mycity.company.net                                                                                                                         
[admin@MikroTik] /certificate>
Nothing is strange.
Then import the second cert
Code: Select all
[admin@MikroTik] /certificate> import file-name=gw.comp.com.crt 
passphrase: 
     certificates-imported: 1
     private-keys-imported: 0
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0

[admin@MikroTik] /certificate> print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                                           COMMON-NAME                                          SUBJECT-ALT-NAME                                                                                                    
 0        T city.crt_0                                     gw.company.com                                                                                                                                
[admin@MikroTik] /certificate>
There is something strange. I have to see two certificates, but there is one, and it is a little bit weird. It has the name from cert1, common-name from cert2. Why is there one certificate? Do i do something wrong?
Top
 
d3st1ny
just joined
Topic Author
Posts: 8
Joined: Thu May 30, 2013 4:23 pm

Re: can't import 2 cert and key

Sat Aug 12, 2017 1:17 am

Guys, trouble in RoS 6.40.1. I downgraded to 6.38.7 - imported all certificates without any problems. Bug presents in ARM and MIPSBE(other platforms i didn't check). It, maybe, will help someone.
Top
 
CodeMonkey
just joined
Posts: 11
Joined: Sun Oct 30, 2011 3:02 am

Re: can't import 2 cert and key

Thu Sep 07, 2017 4:46 am

I am also seeing this behavior on my ROS 6.40.3 and 6.40.1. I wonder if this issue is because the issuer is the same self signed ca. the Cert name, CommonName, and Subject Alt names are different but when I import the second cert it always replaces the first cert imported with the second one. I have tried it from cli and winbox no difference.

So I import flash/NjVpnHubCert.pem
Code: Select all
[admin@MikroTik] > certificate print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                          COMMON-NAME                          SUBJECT-ALT-NAME                                                       FINGERPRINT                         
 0        T VlanCaCert.pem_0              Vlan CA                                                                                                     bb1efe61f13f43d674d1b1ba59804d4f8...
 1        T NjVpnHubCert.pem_0            4X.6X.1X.3X                          IP:4X.6X.1X.3X                                        50d0a486e8159009ff423ae7eadf38a4d...
[admin@MikroTik] >
Then I import flash/OfficeNetCert.pem
Code: Select all
[admin@MikroTik] > certificate print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                          COMMON-NAME                          SUBJECT-ALT-NAME                                                       FINGERPRINT                         
 0        T VlanCaCert.pem_0              Vlan CA                                                                                                     bb1efe61f13f43d674d1b1ba59804d4f8...
 1        T NjVpnHubCert.pem_0            OfficeNet@domain.net                  email:OfficeNet@domain.net           6a39ea886b490d192cee7332d090b04c7...
[admin@MikroTik] >
Notice how the Name part stays the same but the Common-Name and Subject-Alt_Name change as does the fingerprint.

Then I delete NjVpnHubCert.pem and then import flash/OfficeNetCert.pem I get
Code: Select all
admin@MikroTik] > certificate print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #          NAME                          COMMON-NAME                          SUBJECT-ALT-NAME                                                       FINGERPRINT                         
 0        T VlanCaCert.pem_0              Vlan CA                                                                                                     bb1efe61f13f43d674d1b1ba59804d4f8...
 1        T OfficeNetCert.pem_0           OfficeNet@domain.net                  email:OfficeNet@domain.net              6a39ea886b490d192cee7332d090b04c7...
[admin@MikroTik] >
When I import them one at a time and view their details they are good. I can import either one first and the second one will always overwrite the first one whichever I do first and second.

I am running this on a CRS326-24G-2S+. Is this support ticket area we are into now? Anyone else having an issue like this except the two of us?

Thanks.
CodeMonkey
Top
 
slyz
just joined
Posts: 7
Joined: Tue Sep 06, 2016 5:51 pm

Re: can't import 2 cert and key

Mon Jan 22, 2018 3:02 pm

Same problem. One certificate overwrites the other and vice versa.
Top
Post Reply

Who is online

Users browsing this forum: phascogale and 84 guests
  4. RouterOS
  5. General