RouterOS certificates

Certificates live in /certificate. A template describes the certificate you want; signing turns it into a real certificate and deletes the template; the result can be used by services that take a certificate= property. Private keys never leave the router unless you export them with a passphrase, which needs the sensitive user policy.

Create a private CA and a server certificate

/certificate/add name=CA-Template common-name=my-ca key-usage=key-cert-sign,crl-sign days-valid=3650
/certificate/add name=Server-Template common-name=vpn.example.com subject-alt-name=DNS:vpn.example.com days-valid=825
/certificate/sign CA-Template name=my-ca
/certificate/sign Server-Template ca=my-ca name=vpn-server
/certificate/print detail