Managing Certificates on Mikrotik Router with Winbox

Certificates on Mikrotik’s RouterOS can be managed through the web interface or the Winbox software. Below are basic guidelines for configuring a CA to get you started.

Configure the CA

Firstly, create a certificate to be used for the CA (Certificate Authority) signing, then self sign it:

System -> Certificates -> Add New ->
 Name = myCA
 Country = …
 State = …
 Organization = …
 CN =

These values will be the template for all other certificates signed on this CA. Use a real domain in the CN if this CA will issue certificates where your devices will access your services via public domain names, e.g. If the certificates are *only* used for VPN authentication the domain name does not need to be real or registered, but should be consistent across the certificates.

After saving, click the new certificate, and click “Sign”.

Create a Server Certificate

Add a “Server” certificate to be used for tasks on the Router (optional, you can just use the CA cert.):

System -> Certificate -> Add New …

 Name = router
 CN =

Now sign it with myCA:
 System -> Certificates -> click on certificate -> Sign
 Certificate = router
 CA = myCA
-> Start

The certificate is approved and signed immediately.
This certificate can now be used for services on the router.

Client Certificates

Create client certificates as required for VPN’s, etc:

System -> Certificates -> Add New
– use the same values as myCA, except CN: CN =

Sign each certificate using myCA:
 System -> Certificates -> click certificate -> Sign
 Certificate = …
 CA = myCA
 (CRL Host leave blank)

System -> Certificate -> click certificate -> Export
Export the certificate in the required formats with an optional passphrase (better security).

The exported certificates are available for download from the Files menu.
After configuring and testing clients the client certificates should be deleted under Files and Certificates to prevent them being utilized in the case of a compromised router.

SCEP Servers (optional)

Simple Certificate Enrollment Protocol (SCEP) can be used to automate certificate management to a degree (renewals and CRLs – Certificate Revocation Lists).

System -> Certificates -> SCEP Servers -> Add New
 CA Certificate = myCA
 Path = /scep/myCA

System -> Certificates -> Add New -> … -> Sign via SCEP
 Certificate = clientX
 “Sign via SCEP”

System -> Certificates -> Requests -> click certificate -> “Grant”
(appears to create 2 certificates, one with FQDN and another with SCEP URL for renewals).

*Note: The SCEP URL must be constantly accessible, i.e. not DHCP, because the SCEP clients will regularly access the CA to verify the certificate. If the URL becomes inaccessible this will log messages like: “scep client failure: requesting-ca-capabilities-failed“.