Community discussions

MikroTik App
 
codyb88
just joined
Topic Author
Posts: 3
Joined: Thu Jun 29, 2023 7:53 pm

Certificates generating with invalid invalid-before and invalid-after dates

Wed May 22, 2024 10:22 pm

When I generate a certificate, the invalid-before and invalid-after dates are invalid, rendering the certificate unusable:
[admin@MikroTik] /certificate> add name=LocalCA common-name=LocalCA key-usage=key-cert-sign,crl-sign
[admin@MikroTik] /certificate> print detail 
Flags: K - private-key; L - crl; C - smart-card-key; A - authority; I - issued, R - revoked; E - expired; T - trusted 
 0       T name="DigiCertGlobalRootG2" issuer=C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert Global Root G2 digest-algorithm=sha256 key-type=rsa country="US" 
           organization="DigiCert Inc" unit="www.digicert.com" common-name="DigiCert Global Root G2" key-size=2048 subject-alt-name="" days-valid=8933 trusted=yes 
           key-usage=digital-signature,key-cert-sign,crl-sign serial-number="033af1e6a711a9a0bb2864b11d09fae5" 
           fingerprint="cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f" akid="" skid=4e2254201895e6e36ee60ffafab912ed06178f39 invalid-before=2013-08-01 05:00:00 
           invalid-after=2038-01-15 05:00:00 expires-after=712w1d16h44m48s 

 1         name="LocalCA" key-type=rsa common-name="LocalCA" key-size=2048 subject-alt-name="" days-valid=365 key-usage=key-cert-sign,crl-sign akid="" skid="" 
           invalid-before=1969-12-31 17:00:00 invalid-after=1969-12-31 17:00:00

[admin@MikroTik] /certificate> /system/routerboard/print   
       routerboard: yes
        board-name: hAP ac^2
             model: RBD52G-5HacD2HnD
          revision: r3
     serial-number: [redacted
     firmware-type: ipq4000L
  factory-firmware: 6.48.6
  current-firmware: 7.14.3
  upgrade-firmware: 7.14.3
 
rplant
Member
Member
Posts: 367
Joined: Fri Sep 29, 2017 11:42 am

Re: Certificates generating with invalid invalid-before and invalid-after dates

Fri May 24, 2024 11:00 am

You need to have correct time/date/timezone on the mikrotik.
You need to specify number of days valid. (eg. 730 for ~2years)
 
codyb88
just joined
Topic Author
Posts: 3
Joined: Thu Jun 29, 2023 7:53 pm

Re: Certificates generating with invalid invalid-before and invalid-after dates

Fri May 24, 2024 5:27 pm

The date, time, and time zone are correctly set:

[admin@MikroTik] > /system/clock/print   
                  time: 07:19:47
                  date: 2024-05-24
  time-zone-autodetect: yes
        time-zone-name: America/Los_Angeles
            gmt-offset: -07:00
            dst-active: yes

As the details of the certificate show, days-valid is 365.
 
User avatar
eworm
Forum Guru
Forum Guru
Posts: 1075
Joined: Wed Oct 22, 2014 9:23 am
Location: Oberhausen, Germany
Contact:

Re: Certificates generating with invalid invalid-before and invalid-after dates  [SOLVED]

Sat May 25, 2024 12:22 am

What you created is just a template, not a certificate. You need to (self-)sign it to become a certificate, and it should have valid dates then.
 
codyb88
just joined
Topic Author
Posts: 3
Joined: Thu Jun 29, 2023 7:53 pm

Re: Certificates generating with invalid invalid-before and invalid-after dates

Sat May 25, 2024 12:55 am

What you created is just a template, not a certificate. You need to (self-)sign it to become a certificate, and it should have valid dates then.

:facepalm: This was it, I'm embarrassed. The cert needed to be signed.

Thank you for the help!

Who is online

Users browsing this forum: Amazon [Bot], Google [Bot], infabo, mike7 and 20 guests