mirror.MikroTik/eworm-de.routeros-scripts_main
1
0
Fork 0
mirror of https://github.com/eworm-de/routeros-scripts.git synced 2025-08-04 02:04:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

certs: E1 / E5 -> ISRG Root X2

Browse source 
In the beginning of Let's Encrypt their root certificate ISRG Root X1
was not widely trusted, at least some older and/or mobile platforms were
missing that certificate in their root certificate store.
At that time Let's Encrypt was using an alternative chain of trust,
where a certificate was cross-signed with DST Root CA X3.

To make sure a valid chain of trust is available under all circumstances
a set of all certificates had to be supplied: both root vertificates
ISRG Root X1 & DST Root CA X3, and an intermediate certificate.
This was still true after DST Root CA X3 expired, as it could still be
used as a root anchor and was shipped by Let's Encrypt when requested. 🤪

This time is finally over, and we have a clean chain for trust ending in
ISRG Root X1 (or ISRG Root X2).
Well, actually it is the other way round... Let's Encrypt signs with
different tantamount intermediate certificates. There is not only E5, but
also E6 - and we can not know beforehand which one is used on renew.

So let's jetzt drop the intermediate certificates now, and rely on root
certificates only. We are perfectly fine with this these days.

Follow-up commits will do the same for *all* certificates.

The certificate is downloaded with:

    curl -d '["ISRG Root X2"]' https://mkcert.org/generate/ | grep -v '^$' > certs/ISRG-Root-X2.pem
This commit is contained in:
Christian Hesse 2024-06-20 09:50:39 +02:00
parent 35f4ec0b1d
commit d1693a241b
10 changed files with 38 additions and 263 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -69,34 +69,32 @@ download the certificates. If you intend to download the scripts from a
different location (for example from github.com) install the corresponding
certificate chain.
/tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/E5.pem" dst-path="letsencrypt-E5.pem";
/tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/ISRG-Root-X2.pem" dst-path="ISRG-Root-X2.pem";
![screenshot: download certs](README.d/01-download-certs.avif)
Note that the commands above do *not* verify server certificate, so if you
want to be safe download with your workstations's browser and transfer the
files to your MikroTik device.
file to your MikroTik device.
* [ISRG Root X2](https://letsencrypt.org/certs/isrg-root-x2.pem)
* Let's Encrypt [E5](https://letsencrypt.org/certs/2024/e5.pem)
Then we import the certificates.
Then we import the certificate.
/certificate/import file-name=letsencrypt-E5.pem passphrase="";
/certificate/import file-name=ISRG-Root-X2.pem passphrase="";
Do not worry that the command is not shown - that happens because it contains
a sensitive property, the passphrase.
![screenshot: import certs](README.d/02-import-certs.avif)
For basic verification we rename the certificates and print them by
fingerprint. Make sure exactly these two certificates ("*E5*" and
"*ISRG-Root-X2*") are shown. Also remove the left over file.
For basic verification we rename the certificate and print it by
fingerprint. Make sure exactly this one certificate ("*ISRG-Root-X2*")
is shown. Also remove the left over file.
/certificate/set name="E5" [ find where common-name="E5" ];
/certificate/set name="ISRG-Root-X2" [ find where common-name="ISRG Root X2" ];
/certificate/print proplist=name,fingerprint where fingerprint="e788d14b0436b5120bbee3f15c15badf08c1407fe72568a4f16f9151c380e1e3" or fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470";
/file/remove [ find where name="letsencrypt-E5.pem" ];
/certificate/print proplist=name,fingerprint where fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470";
/file/remove [ find where name="ISRG-Root-X2.pem" ];
![screenshot: check certs](README.d/03-check-certs.avif)