Difference between revisions of "Mikrotik: Certificate Generate"
Jump to navigation
Jump to search
Print
Onnowpurbo (talk | contribs) |
Onnowpurbo (talk | contribs) |
||
| Line 60: | Line 60: | ||
Referensi: https://labkom.co.id/mikrotik/membuat-openvpn-di-mikrotik-dengan-client-windows | Referensi: https://labkom.co.id/mikrotik/membuat-openvpn-di-mikrotik-dengan-client-windows | ||
| + | |||
| + | vi auth.conf | ||
| + | |||
| + | |||
| + | |||
| + | vi client1.ovpn | ||
dev tun | dev tun | ||
| Line 76: | Line 82: | ||
auth SHA1 | auth SHA1 | ||
pull | pull | ||
| − | auth-user-pass 123456789 | + | # auth-user-pass 123456789 |
# route 172.17.0.1 255.255.255.0 172.31.31.1 | # route 172.17.0.1 255.255.255.0 172.31.31.1 | ||
Revision as of 16:11, 19 February 2022
Make certificate templates
/certificate add name=ca-template common-name=myCa key-usage=key-cert-sign,crl-sign add name=server-template common-name=server add name=client1-template common-name=client1 add name=client2-template common-name=client2
Sign certificates and add CRL url
Kita menggunakan IP public Mikrotik sebagai CRL URL. Proses ini butuh waktu, harus dilakukan satu per satu; jangan sekaligus.
/certificate # sign ca-template ca-crl-host=192.168.88.198 name=myCa sign ca-template ca-crl-host=192.168.0.150 name=myCa sign server-template ca=myCa name=server sign client1-template ca=myCa name=client1 sign client2-template ca=myCa name=client2
Trust Certificate
/certificate set myCa trusted=yes set server trusted=yes
Export Certificate
Export client certificates with keys and CA certificate:
/certificate export-certificate myCa # /certificate export-certificate client1 export-passphrase=xxxxxxxx # /certificate export-certificate client2 export-passphrase=xxxxxxxx /certificate export-certificate client1 export-passphrase=123456789 /certificate export-certificate client2 export-passphrase=123456789
FTP untuk download file crt & key. Dari Linux Client
ftp ip-mikrotik username admin
mget * quit
[admin@pe0] /certificate> print Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted # NAME COMMON-NAME FINGERPRINT 0 K L A T myCa myCa 7fa636e6576495fe78f1a4... 1 K I T server server cf0650a291bf4685f2fbd3... 2 K I client1 client1 26233de30e89b203b946ab... 3 K I client2 client2 cf172b62201befaf8d8966...
Client UBUNTU
Referensi: https://labkom.co.id/mikrotik/membuat-openvpn-di-mikrotik-dengan-client-windows
vi auth.conf
vi client1.ovpn
dev tun proto tcp-client remote (IP Public OpenVPN Mikrotik) 1194 ca cert_export_myCa.crt cert cert_export_client1.crt key cert_export_client1.key tls-client port 1194 persist-tun persist-key mute-replay-warnings verb 3 cipher AES-256-CBC auth SHA1 pull # auth-user-pass 123456789 # route 172.17.0.1 255.255.255.0 172.31.31.1