Component: certificate
153 changelog entries across 57 version(s)
Activity over time (changelog entries per month)
- fixed empty trust store handling in certain cases (introduced in v7.21);
- added certificate "trust-store" parameter;
- added option to configure built-in trust store (replaced "builtin-trust-anchors" parameter);
- added SHA384, SHA512 support for SCEP;
- allow ca-crl-host parameter for issued certificates;
- fixed incorrect appearance of "invalid-before" and "invalid-after" dates;
- improved logging;
- on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key;
- refactored Certificate internal processes;
- added "Amazon Root CA 1" to built-in root certificate authorities store;
- fixed ACME certificate usage after renewal;
- improved stability after failed import;
- trust built-in root certificate authority store after configuration reset;
- fixed support for certificates imported or added in RouterOS v7.4 or earlier (introduced in v7.19);
- added built-in root certificate authorities store;
- do not include CA identity in SCEP POST requests;
- fixed cloud-dns challenge validation for sn.mynetname.net (CLI only);
- improve error message when trying to use certificate;
- optimize trust store;
- fixed localized text conversion to UTF-8 on certificate creation;
- do not download CRL if there is not enough free RAM;
- do not show not relevant values for certificate template (CLI only);
- fixed handling of capsman-cap certificates (introduced in v7.16);
- removed unstructured address field support;
- do not download CRL if there is not enough free RAM;
- fixed handling of capsman-cap certificates (introduced in v7.16);
- added no-key-export parameter for import;
- added support for cloud-dns challenge validation for sn.mynetname.net (CLI only);
- automatically parse uppercase symbols to lowercase when registering domain on Let's Encrypt;
- improved DNS challenge error reporting for Let's Encrypt;
- improved RSA key signature processing speed;
- show validity beyond year 2038;
- added support for different ACME servers for ssl-certificate (CLI only);
- added support for importing pbes2 encrypted private keys with aes128;
- added trusted parameter for certificate import;
- allow replacing certificate with internal import;
- delete certificate related files automatically from storage after import;
- improved RSA key signature processing speed;
- improved certificate validation performance;
- add support for multiple DNS names for Let's Encrypt;
- added HTTP redirect support for CRL download;
- added support for certificates with key size 16384;
- fixed CRL updating;
- fixed certificate auto renewal via SCEP when certificate contains "subject-alt-name";
- improved CRL signature verification and download error messages;
- improved initial certificate creation using SCEP;
- use error topic for CRL update failures;
- allow to get and maintain Let's Encrypt certificate in IPv6 environment;
- allow to remove issued certificates when CRL is not used;
- fixed "subject-alt-name" duplicating itself when SCEP is used;
- fixed certificate auto renewal via SCEP;
- improved certificate validation logging error messages;
- log CRL HTTP errors under the "error" logging topic;
- allow to import certificate with DNS name constraint;
- fixed PEM import;
- fixed trust store CRL link if generated on an older version (introduced in v7.7);
- improved CRL download retry handling;
- removed request for "passphrase" property on import;
- require CRL presence when using "crl-use=yes" setting;
- restored RSA with SHA512 support;
- fixed displaying of certificate serial number;
- improved error reporting for Let's Encrypt certificate;
- restore available "key-usage" property options;
- fixed bogus log messages;
- fixed export of a certificate when the last line of the certificate is exactly 64 bytes long;
- fixed PBES2 certificate import;
- improved certificate management, signing and storing processes;
- improved multiple certificate import process;
- improved Let's Encrypt logging and error recovery;
- improved certificate management, signing and storing processes;
- fixed SHA1 certificate name lookup;
- improved certificate management, signing and storing processes;
- restricted maximum retry attempt window for Let's Encrypt certificate to 60 minutes;
- fixed handling of empty AKID by SCEP client;
- fixed new CRL updating;
- allow to choose digest algorithm for CSR signing;
- made "fingerprint" parameter read-only;
- improved stability when sending bogus SCEP message;
- improved stability when sending bogus SCEP message;
- improved stability when removing dynamic CRL entries;
- clear challenge password on renew;
- fixed CRL URL length limit;
- fixed private key verification for CA certificate during signing process;
- generate CRL even when CRL URL not specified;
- properly flush expired SCEP OTP entries;
- added "skid" and "akid" values for detailed print;
- allow dynamic CRL removal;
- disabled CRL usage by default;
- do not use SSL for first CRL update;
- fixed certificate verification when flushing CRL's;
- fixed certificate verification when flushing CRL's;
- added progress bar when creating certificate request;
- added support for certificate request signing with EC keys;
- allow specifying "file-name" parameter for export (CLI only);
- allow specifying "name" parameter for import (CLI only);
- improved CRL updating process;
- removed "key-size" parameter for "create-certificate-request" command;
- renew certificates via SCEP when 3/4 of lifetime reached;
- removed "set-ca-passphrase" parameter;
- added "key-type" field;
- added support for ECDSA certificates (prime256v1, secp384r1, secp521r1);
- fixed self signed CA certificate handling by SCEP client;
- made RAM the default CRL storage location;
- removed DSA (D) flag;
- removed "set-ca-passphrase" parameter;
- fixed SAN being duplicated on status change (introduced in v6.44);
- force 3DES encryption for P12 certificate export;
- force 3DES encryption for P12 certificate export;
- added support for multiple "Subject Alt. Names";
- enabled RC2 cipher to allow P12 certificate decryption;
- fixed certificate signing by SCEP client if multiple CA certificates are provided;
- show digest algorithm used in signature;
- properly flush old CRLs when changing store location;
- fixed "expires-after" parameter calculation;
- fixed time zone adjustment for SCEP requests;
- properly flush old CRLs when changing store location;
- fixed time zone adjustment for SCEP requests;
- added "expires-after" parameter;
- do not allow to perform "undo" on certificate changes;
- fixed RA "server-url" setting;
- fixed "add-scep" template existence check when signing certificate;
- fixed "add-scep" template existence check when signing certificate;
- fixed incorrect SCEP URL after an upgrade;
- added PKCS#10 version check;
- dropped DES support and added AES instead for SCEP;
- dropped MD5 support and require SHA1 as minimum for SCEP;
- fixed incorrect SCEP URL after an upgrade;
- do not use UTF-8 for SCEP challenge password;
- fixed PKCS#10 version;
- do not use utf8 for SCEP challenge password;
- fixed PKCS#10 version;
- added option to store CRL in RAM (CLI only);
- fixed SCEP "get" request URL encoding;
- improved CRL update after system startup;
- show "Expired" flag when initial CRL fetch fails;
- show invalid flag when local CRL file does not exist;
- fixed import of certificates with empty SKID;
- SCEP client now supports FQDN URL and port;
- allow CRL address to be specified as DNS name;
- added year cap (invalid-after date will not exceed year 2039);
- fixed fail on import from CAPs when both key and name already exist;
- do not allow to remove certificate template while signing certificate;
- added automatic scep renewal delay after startup to avoid all requests accessing CA at the same time;
- cancel pending renew when certificate becomes valid after date change;
- display issuer and subject on check failure;
- do not exit after card-verify;
- force scep renewal on system clock updates;
- revoked certificates not showing as (R)evoked;
- allow manual crl url addition;
- fix CRL handling in trust chain;
- support ip, dns and email subject alternative names;
- no more 'reset-certificate-cache' and 'decrypt' commands,
- merged '/certificate ca issued', '/certificate scep client' and