Compare commits

...

3 commits

Author SHA1 Message Date
Christian Hesse
bf684a7197 global-functions: $CertificateAvailable: try to use builtin certificates
The builtin certificates were introduced with RouterOS 7.19, so requires
this hacky :parse workaround.
2025-05-28 15:08:26 +02:00
Christian Hesse
d59c4aee26 README: add a paragraph and link to jump 2025-05-28 14:16:57 +02:00
Christian Hesse
3d3b270748 README: give a hint on builtin certificate store
I guess this should become the default any time in future...
2025-05-28 14:07:57 +02:00
2 changed files with 16 additions and 1 deletions

View file

@ -72,7 +72,15 @@ including demonstation recorded live at [MUM Europe
### The long way in detail
The update script does server certificate verification, so first step is to
download the certificates. If you intend to download the scripts from a
download the certificates.
> 💡️ **Hint**: RouterOS 7.19 comes with a builtin certificate store. You
> can skip the steps regarding certificate download and import and jump
> to [installation of scripts](#installation-of-scripts) if you set the
> trust for these builtin trust anchors:
> `/certificate/settings/set builtin-trust-anchors=trusted;`
If you intend to download the scripts from a
different location (for example from github.com) install the corresponding
certificate chain.
@ -106,6 +114,8 @@ is shown.
Always make sure there are no certificates installed you do not know or want!
#### Installation of scripts
All following commands will verify the server certificate. For validity the
certificate's lifetime is checked with local time, so make sure the device's
date and time is set correctly!

View file

@ -119,6 +119,11 @@
:return false;
}
:if (([ /certificate/settings/get ]->"builtin-trust-anchors") = "trusted" && \
[[ :parse (":return [ :len [ /certificate/builtin/find where common-name=\"" . $CommonName . "\" ] ]") ]] > 0) do={
:return true;
}
:if ([ :len [ /certificate/find where common-name=$CommonName ] ] = 0) do={
$LogPrint info $0 ("Certificate with CommonName '" . $CommonName . "' not available.");
:if ([ $CertificateDownload $CommonName ] = false) do={