/ip service set telnet address=192.168.1.2/32 disabled=yes
/ip service set ftp address=192.168.1.2/32 disabled=yes
/ip service set www address=192.168.1.2/32 disabled=no
/ip service set ssh address=192.168.1.2/32 disabled=no
/ip service set www-ssl address=192.168.1.2/32 disabled=yes certificate=$myCERT tls-version=only-1.2
/ip service set api address=192.168.1.2/32 disabled=yes
/ip service set winbox address=192.168.1.2/32 disabled=yes
/ip service set api-ssl address=192.168.1.2/32 disabled=yes certificate=$myCERT tls-version=only-1.2

/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none
/tool mac-server ping set enabled=no
/tool romon set enabled=no

:global myCERT "WEBFIG";
:global myCERTCN "TEST.example.com";
:global myCERTSAN "IP:192.168.1.88";
:global myCERTO "EXAMPLE.COM";
:global myCERTOU "TEST";
:global myCERTC "SE";
:global myCERTVALID "730";
:global myCERTDATE "2024-08-01";
:global myCERTTIME "12:00:00";

/system/clock/set date=$myCERTDATE time=$myCERTTIME
/certificate add name=$myCERT digest-algorithm=sha256 country=$myCERTC organization=$myCERTO unit=$myCERTOU common-name=$myCERTCN key-size=2048 subject-alt-name=$myCERTSAN days-valid=$myCERTVALID trusted=yes key-usage=digital-signature,key-cert-sign,crl-sign,tls-server 
/certificate sign $myCERT

/ip service set www address=192.168.1.2/32 disabled=yes
/ip service set www-ssl address=192.168.1.2/32 disabled=no certificate=$myCERT tls-version=only-1.2
[code]

Of course you can and need adjust the above to your choice like if you want key-size=4096 instead of 2048 etc. Note that increased keysize will take more time to generate the cert but also use more cpu once you login to your Mikrotik using https. So unless you administer your Mikrotik over the Internet a keysize of 2048 bits is often good enough even these days.

Edit: Make sure to use latest stable release which is 7.15.3 stable as of writing.

According to MikroTik’s blog, the attackers exploited a vulnerability in the router’s operating system (RouterOS) which enabled attackers to gain unauthenticated remote access to read and write arbitrary files (CVE-2018-14847).

RouterOS is the router operating system that’s used by MikroTik’s routers and the RouterBOARD hardware product family, which can also be used to turn any PC into a router. Administration of RouterOS can be done either via direct SSH connection or by using a configuration utility called WinBox. The vulnerability itself was possible due to a directory traversal vulnerability in the WinBox interface with RouterOS.