{
  "date": "2026-10-11",
  "block": "12.5.134",
  "runtime": {
    "backend": "ux-log133",
    "frontend": "ux-log133"
  },
  "native": {
    "date": "2026-10-11",
    "block": "12.5.134",
    "name": "mm-ipsec134-1791693461031",
    "observations": [
      {
        "phase": "valid-crl-download",
        "rows": [
          {
            ".id": "*8",
            "url": "http://161.104.46.222:18084/crl/255.crl",
            "cert": "mm-ipsec134-1791693461031-ca",
            "invalid": "false",
            "expired": "false",
            "dynamic": "true",
            "revoked": "0",
            "last-update": "2026-10-11 06:37:44",
            "next-update": "2027-10-11 06:37:42"
          },
          {
            ".id": "*9",
            "url": "http://161.104.46.222:18084/crl/255.crl",
            "cert": "mm-ipsec134-1791693461031-client",
            "invalid": "true",
            "dynamic": "true",
            "revoked": "unknown"
          }
        ]
      },
      {
        "phase": "missing-crl-url",
        "rows": [
          {
            ".id": "*8",
            "url": "http://161.104.46.222:18084/crl/255.crl",
            "cert": "mm-ipsec134-1791693461031-ca",
            "invalid": "false",
            "expired": "false",
            "dynamic": "true",
            "revoked": "0",
            "last-update": "2026-10-11 06:37:44",
            "next-update": "2027-10-11 06:37:42"
          },
          {
            ".id": "*9",
            "url": "http://161.104.46.222:18084/crl/255.crl",
            "cert": "mm-ipsec134-1791693461031-client",
            "invalid": "false",
            "expired": "false",
            "dynamic": "true",
            "revoked": "0",
            "last-update": "2026-10-11 06:37:45",
            "next-update": "2027-10-11 06:37:42"
          },
          {
            ".id": "*A",
            "url": "http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
            "cert": "none",
            "invalid": "true",
            "dynamic": "false",
            "revoked": "unknown"
          }
        ]
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/certificate": true,
        "/certificate/crl": true,
        "/file": true,
        "/system/logging": true,
        "/system/logging/action": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/certificate": true,
        "/certificate/crl": true,
        "/file": true,
        "/system/logging": true,
        "/system/logging/action": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "endpointRequests": [
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl-missing-mm-ipsec134-1791693461031",
        "source": "172.18.0.1",
        "status": 404
      },
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl",
        "source": "104.165.244.7",
        "status": 200
      },
      {
        "method": "GET",
        "path": "/crl/255.crl-missing-mm-ipsec134-1791693461031",
        "source": "104.165.244.7",
        "status": 404
      }
    ],
    "distributionUrl": "http://161.104.46.222:18084/crl/255.crl",
    "httpControl": {
      "origin": "http://194.226.121.150/crl/255.crl",
      "status": 200,
      "bytes": 423,
      "parsed": "issuer=CN = mm-ipsec134-1791693461031-ca\nlastUpdate=Oct 11 04:37:42 2026 GMT\nnextUpdate=Oct 11 04:37:42 2027 GMT"
    },
    "receiverHttpControl": [
      {
        ".section": "0",
        "status": "connecting"
      },
      {
        ".section": "1",
        "code": "200",
        "downloaded": "1",
        "duration": "1s",
        "status": "finished",
        "total": "1"
      }
    ],
    "settingsBefore": {
      "builtin-trust-store": "default",
      "crl-download": "false",
      "crl-store": "ram",
      "crl-use": "false",
      "current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
    },
    "imports": [
      [
        {
          "certificates-imported": "1",
          "decryption-failures": "0",
          "files-imported": "0",
          "keys-with-no-certificate": "0",
          "private-keys-imported": "0"
        }
      ],
      [
        {
          "certificates-imported": "1",
          "decryption-failures": "0",
          "files-imported": "0",
          "keys-with-no-certificate": "0",
          "private-keys-imported": "0"
        }
      ]
    ],
    "downloadReceipt": {
      "automaticDownloadInProgress": true
    },
    "missingHttpStatus": 404,
    "negativeDownloadReceipt": {
      "automaticDownloadInProgress": true
    },
    "receiverMissingRequestObserved": true,
    "success": true,
    "receiverLogs": [
      {
        "message": "mm-ipsec134-1791693461031: looking for CRLs in mm-ipsec134-1791693461031-ca",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: found CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: start CRL update",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: new fingerprint [hash]",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: completed for mm-ipsec134-1791693461031-ca",
        "time": "2026-10-11 06:37:44",
        "topics": "certificate,info"
      },
      {
        "message": "mm-ipsec134-1791693461031: looking for CRLs in mm-ipsec134-1791693461031-client",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: found CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: start CRL update",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: unchanged",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: new fingerprint [hash]",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: completed for mm-ipsec134-1791693461031-client",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,info"
      },
      {
        "message": "mm-ipsec134-1791693461031: start CRL update",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: unchanged",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: crl update: unchanged",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,debug"
      },
      {
        "message": "mm-ipsec134-1791693461031: CRL fetch failed: http code: 404 for: http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
        "time": "2026-10-11 06:37:45",
        "topics": "certificate,error"
      }
    ],
    "baselineIds": [
      {
        "/certificate": [],
        "/certificate/crl": [],
        "/file": [
          "**Qb24a2KNOW6Ay8FA4",
          "**NQMkAHKnbvKDA",
          "**YHreAtYW0Rzfws6wJ5xXOmqd4"
        ],
        "/system/logging": [
          "*1",
          "*2",
          "*3",
          "*4"
        ],
        "/system/logging/action": [
          "*0",
          "*1",
          "*2",
          "*3"
        ],
        "/ip/ipsec/identity": [],
        "/ip/ipsec/peer": [],
        "/ip/address": [
          "*1"
        ],
        "/ip/route": [
          "*80000003",
          "*80000004",
          "*80000005",
          "*20145010"
        ],
        "/ip/firewall/nat": []
      },
      {
        "/certificate": [],
        "/certificate/crl": [],
        "/file": [
          "**Qb24a2KNOW6Ay8FA4",
          "**NQMkAHKnbvKDA",
          "**YHreAtYW0Rzfws6wJ5xXOmqd4"
        ],
        "/system/logging": [
          "*1",
          "*2",
          "*3",
          "*4"
        ],
        "/system/logging/action": [
          "*0",
          "*1",
          "*2",
          "*3"
        ],
        "/ip/ipsec/identity": [],
        "/ip/ipsec/peer": [],
        "/ip/address": [
          "*2",
          "*3"
        ],
        "/ip/route": [
          "*80000003",
          "*80000005",
          "*20145020",
          "*80000004",
          "*20145010"
        ],
        "/ip/firewall/nat": []
      }
    ],
    "owned": [
      {
        "i": 1,
        "path": "/system/logging/action",
        "id": "*9",
        "name": "mmipsec1341791693461031"
      },
      {
        "i": 1,
        "path": "/system/logging",
        "id": "*11",
        "prefix": "mm-ipsec134-1791693461031",
        "action": "mmipsec1341791693461031",
        "topics": "certificate,!packet"
      },
      {
        "i": 0,
        "path": "/certificate",
        "id": "*FF",
        "name": "mm-ipsec134-1791693461031-ca"
      },
      {
        "i": 0,
        "path": "/certificate",
        "id": "*100",
        "name": "mm-ipsec134-1791693461031-client"
      },
      {
        "i": 0,
        "path": "/file",
        "id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZXPMjI8887qz45YyIe",
        "name": "cert_export_mm-ipsec134-1791693461031-ca.crt"
      },
      {
        "i": 0,
        "path": "/file",
        "id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxeLKU4HEAuyinq4lwqRqRQ4C",
        "name": "cert_export_mm-ipsec134-1791693461031-client.crt"
      },
      {
        "i": 1,
        "path": "/file",
        "id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIoxxasetmQdJxwQXCdw",
        "name": "flash/mm-ipsec134-1791693461031-ca.crt",
        "consumedByImport": true
      },
      {
        "i": 1,
        "path": "/certificate",
        "id": "*8A",
        "name": "mm-ipsec134-1791693461031-ca"
      },
      {
        "i": 1,
        "path": "/file",
        "id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIC9zsm1ZP3mojpWSqBhI860S",
        "name": "flash/mm-ipsec134-1791693461031-client.crt",
        "consumedByImport": true
      },
      {
        "i": 1,
        "path": "/certificate",
        "id": "*8B",
        "name": "mm-ipsec134-1791693461031-client"
      },
      {
        "i": 1,
        "path": "/certificate/crl",
        "id": "*A",
        "url": "http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031"
      }
    ],
    "settingsRestored": true,
    "endpointClosed": true
  },
  "initialAttempts": {
    "first": {
      "protocol": {
        "date": "2026-10-11",
        "block": "12.5.134",
        "name": "mm-ipsec134-1791692971804",
        "observations": [],
        "cleanup": [],
        "distributionUrl": "http://194.226.121.150/crl/247.crl",
        "httpControl": {
          "status": 200,
          "bytes": 423,
          "parsed": "issuer=CN = mm-ipsec134-1791692971804-ca\nlastUpdate=Oct 11 04:29:32 2026 GMT\nnextUpdate=Oct 11 04:29:32 2027 GMT"
        },
        "settingsBefore": {
          "builtin-trust-store": "default",
          "crl-download": "false",
          "crl-store": "ram",
          "crl-use": "false",
          "current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
        },
        "imports": [
          [
            {
              "certificates-imported": "1",
              "decryption-failures": "0",
              "files-imported": "0",
              "keys-with-no-certificate": "0",
              "private-keys-imported": "0"
            }
          ],
          [
            {
              "certificates-imported": "1",
              "decryption-failures": "0",
              "files-imported": "0",
              "keys-with-no-certificate": "0",
              "private-keys-imported": "0"
            }
          ]
        ],
        "error": "RouterOS API error 400 on /certificate/crl/download: {\"detail\":\"failure: CRL download in progress\",\"error\":400,\"message\":\"Bad Request\"}"
      },
      "cleanupError": "Fixture ownership changed: RouterOS consumed uploaded public certificate files after import",
      "recovery": {
        "name": "mm-ipsec134-1791692971804",
        "checks": [
          {
            "serverId": 2,
            "certificates": 0,
            "crls": 0,
            "ownedFilesRemoved": 0,
            "otherFilesPreserved": true,
            "settingsRestored": true
          },
          {
            "serverId": 1,
            "certificates": 0,
            "crls": 0,
            "ownedFilesRemoved": 2,
            "otherFilesPreserved": true,
            "settingsRestored": true
          }
        ]
      }
    },
    "second": {
      "date": "2026-10-11",
      "block": "12.5.134",
      "name": "mm-ipsec134-1791693116777",
      "observations": [
        {
          "phase": "valid-crl-download",
          "rows": [
            {
              ".id": "*3",
              "url": "http://194.226.121.150/crl/249.crl",
              "cert": "mm-ipsec134-1791693116777-ca",
              "invalid": "true",
              "dynamic": "true",
              "revoked": "unknown"
            },
            {
              ".id": "*4",
              "url": "http://194.226.121.150/crl/249.crl",
              "cert": "mm-ipsec134-1791693116777-client",
              "invalid": "true",
              "dynamic": "true",
              "revoked": "unknown"
            }
          ]
        }
      ],
      "cleanup": [
        {
          "serverId": 1,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        },
        {
          "serverId": 2,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        }
      ],
      "distributionUrl": "http://194.226.121.150/crl/249.crl",
      "httpControl": {
        "status": 200,
        "bytes": 423,
        "parsed": "issuer=CN = mm-ipsec134-1791693116777-ca\nlastUpdate=Oct 11 04:31:58 2026 GMT\nnextUpdate=Oct 11 04:31:58 2027 GMT"
      },
      "settingsBefore": {
        "builtin-trust-store": "default",
        "crl-download": "false",
        "crl-store": "ram",
        "crl-use": "false",
        "current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
      },
      "imports": [
        [
          {
            "certificates-imported": "1",
            "decryption-failures": "0",
            "files-imported": "0",
            "keys-with-no-certificate": "0",
            "private-keys-imported": "0"
          }
        ],
        [
          {
            "certificates-imported": "1",
            "decryption-failures": "0",
            "files-imported": "0",
            "keys-with-no-certificate": "0",
            "private-keys-imported": "0"
          }
        ]
      ],
      "downloadReceipt": {
        "automaticDownloadInProgress": true
      },
      "error": "Valid external CRL did not load",
      "baselineIds": [
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*1"
          ],
          "/ip/route": [
            "*80000003",
            "*80000004",
            "*80000005",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        },
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*2",
            "*3"
          ],
          "/ip/route": [
            "*80000003",
            "*80000005",
            "*20145020",
            "*80000004",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        }
      ],
      "owned": [
        {
          "i": 0,
          "path": "/certificate",
          "id": "*F9",
          "name": "mm-ipsec134-1791693116777-ca"
        },
        {
          "i": 0,
          "path": "/certificate",
          "id": "*FA",
          "name": "mm-ipsec134-1791693116777-client"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZSOF4mBUsI7ufoMjjA",
          "name": "cert_export_mm-ipsec134-1791693116777-ca.crt"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxdxntIScRSyOZNg9iRz3PLyG",
          "name": "cert_export_mm-ipsec134-1791693116777-client.crt"
        },
        {
          "i": 1,
          "path": "/file",
          "id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIoswTE8x9AnatY9Ky4S",
          "name": "flash/mm-ipsec134-1791693116777-ca.crt",
          "consumedByImport": true
        },
        {
          "i": 1,
          "path": "/certificate",
          "id": "*86",
          "name": "mm-ipsec134-1791693116777-ca"
        },
        {
          "i": 1,
          "path": "/file",
          "id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIBmTI0CxfbmUVN7qbnEV61uW",
          "name": "flash/mm-ipsec134-1791693116777-client.crt",
          "consumedByImport": true
        },
        {
          "i": 1,
          "path": "/certificate",
          "id": "*87",
          "name": "mm-ipsec134-1791693116777-client"
        }
      ],
      "settingsRestored": true
    },
    "third": {
      "date": "2026-10-11",
      "block": "12.5.134",
      "name": "mm-ipsec134-1791693224865",
      "observations": [],
      "cleanup": [
        {
          "serverId": 1,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        },
        {
          "serverId": 2,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        }
      ],
      "distributionUrl": "http://194.226.121.150/crl/251.crl",
      "httpControl": {
        "status": 200,
        "bytes": 423,
        "parsed": "issuer=CN = mm-ipsec134-1791693224865-ca\nlastUpdate=Oct 11 04:33:45 2026 GMT\nnextUpdate=Oct 11 04:33:45 2027 GMT"
      },
      "receiverHttpControl": {
        "error": "RouterOS API error 400 on /tool/fetch: {\"detail\":\"failure: remote disconnected while in HTTP exchange\",\"error\":400,\"message\":\"Bad Request\"}"
      },
      "error": "RouterOS API error 400 on /tool/fetch: {\"detail\":\"failure: remote disconnected while in HTTP exchange\",\"error\":400,\"message\":\"Bad Request\"}",
      "receiverLogs": [],
      "baselineIds": [
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*1"
          ],
          "/ip/route": [
            "*80000003",
            "*80000004",
            "*80000005",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        },
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*2",
            "*3"
          ],
          "/ip/route": [
            "*80000003",
            "*80000005",
            "*20145020",
            "*80000004",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        }
      ],
      "owned": [
        {
          "i": 1,
          "path": "/system/logging/action",
          "id": "*7",
          "name": "mmipsec1341791693224865"
        },
        {
          "i": 1,
          "path": "/system/logging",
          "id": "*F",
          "prefix": "mm-ipsec134-1791693224865",
          "action": "mmipsec1341791693224865",
          "topics": "certificate,!packet"
        },
        {
          "i": 0,
          "path": "/certificate",
          "id": "*FB",
          "name": "mm-ipsec134-1791693224865-ca"
        },
        {
          "i": 0,
          "path": "/certificate",
          "id": "*FC",
          "name": "mm-ipsec134-1791693224865-client"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZU3gID26txDz338Lv2",
          "name": "cert_export_mm-ipsec134-1791693224865-ca.crt"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxe5cpPdnTygqIZnU3vdtSBBk",
          "name": "cert_export_mm-ipsec134-1791693224865-client.crt"
        }
      ]
    },
    "fourth": {
      "date": "2026-10-11",
      "block": "12.5.134",
      "name": "mm-ipsec134-1791693385821",
      "observations": [
        {
          "phase": "valid-crl-download",
          "rows": [
            {
              ".id": "*5",
              "url": "http://161.104.46.222:18084/crl/253.crl",
              "cert": "mm-ipsec134-1791693385821-ca",
              "invalid": "false",
              "expired": "false",
              "dynamic": "true",
              "revoked": "0",
              "last-update": "2026-10-11 06:36:29",
              "next-update": "2027-10-11 06:36:27"
            },
            {
              ".id": "*6",
              "url": "http://161.104.46.222:18084/crl/253.crl",
              "cert": "mm-ipsec134-1791693385821-client",
              "invalid": "true",
              "dynamic": "true",
              "revoked": "unknown"
            }
          ]
        }
      ],
      "cleanup": [
        {
          "serverId": 1,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        },
        {
          "serverId": 2,
          "/certificate": true,
          "/certificate/crl": true,
          "/file": true,
          "/system/logging": true,
          "/system/logging/action": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        }
      ],
      "endpointRequests": [
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl-missing-mm-ipsec134-1791693385821",
          "source": "172.18.0.1",
          "status": 404
        },
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl",
          "source": "104.165.244.7",
          "status": 200
        },
        {
          "method": "GET",
          "path": "/crl/253.crl-missing-mm-ipsec134-1791693385821",
          "source": "104.165.244.7",
          "status": 404
        }
      ],
      "distributionUrl": "http://161.104.46.222:18084/crl/253.crl",
      "httpControl": {
        "origin": "http://194.226.121.150/crl/253.crl",
        "status": 200,
        "bytes": 423,
        "parsed": "issuer=CN = mm-ipsec134-1791693385821-ca\nlastUpdate=Oct 11 04:36:27 2026 GMT\nnextUpdate=Oct 11 04:36:27 2027 GMT"
      },
      "receiverHttpControl": [
        {
          ".section": "0",
          "status": "connecting"
        },
        {
          ".section": "1",
          "code": "200",
          "downloaded": "1",
          "duration": "1s",
          "status": "finished",
          "total": "1"
        }
      ],
      "settingsBefore": {
        "builtin-trust-store": "default",
        "crl-download": "false",
        "crl-store": "ram",
        "crl-use": "false",
        "current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
      },
      "imports": [
        [
          {
            "certificates-imported": "1",
            "decryption-failures": "0",
            "files-imported": "0",
            "keys-with-no-certificate": "0",
            "private-keys-imported": "0"
          }
        ],
        [
          {
            "certificates-imported": "1",
            "decryption-failures": "0",
            "files-imported": "0",
            "keys-with-no-certificate": "0",
            "private-keys-imported": "0"
          }
        ]
      ],
      "downloadReceipt": {
        "automaticDownloadInProgress": true
      },
      "missingHttpStatus": 404,
      "error": "RouterOS API error 400 on /certificate/crl/download: {\"detail\":\"failure: CRL download in progress\",\"error\":400,\"message\":\"Bad Request\"}",
      "receiverLogs": [
        {
          "message": "mm-ipsec134-1791693385821: looking for CRLs in mm-ipsec134-1791693385821-ca",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: found CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: start CRL update",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: new fingerprint [hash]",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: completed for mm-ipsec134-1791693385821-ca",
          "time": "2026-10-11 06:36:29",
          "topics": "certificate,info"
        },
        {
          "message": "mm-ipsec134-1791693385821: looking for CRLs in mm-ipsec134-1791693385821-client",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: found CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: start CRL update",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: unchanged",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: new fingerprint [hash]",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: completed for mm-ipsec134-1791693385821-client",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,info"
        },
        {
          "message": "mm-ipsec134-1791693385821: start CRL update",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: crl update: unchanged",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        },
        {
          "message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
          "time": "2026-10-11 06:36:30",
          "topics": "certificate,debug"
        }
      ],
      "baselineIds": [
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*1"
          ],
          "/ip/route": [
            "*80000003",
            "*80000004",
            "*80000005",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        },
        {
          "/certificate": [],
          "/certificate/crl": [],
          "/file": [
            "**Qb24a2KNOW6Ay8FA4",
            "**NQMkAHKnbvKDA",
            "**YHreAtYW0Rzfws6wJ5xXOmqd4"
          ],
          "/system/logging": [
            "*1",
            "*2",
            "*3",
            "*4"
          ],
          "/system/logging/action": [
            "*0",
            "*1",
            "*2",
            "*3"
          ],
          "/ip/ipsec/identity": [],
          "/ip/ipsec/peer": [],
          "/ip/address": [
            "*2",
            "*3"
          ],
          "/ip/route": [
            "*80000003",
            "*80000005",
            "*20145020",
            "*80000004",
            "*20145010"
          ],
          "/ip/firewall/nat": []
        }
      ],
      "owned": [
        {
          "i": 1,
          "path": "/system/logging/action",
          "id": "*8",
          "name": "mmipsec1341791693385821"
        },
        {
          "i": 1,
          "path": "/system/logging",
          "id": "*10",
          "prefix": "mm-ipsec134-1791693385821",
          "action": "mmipsec1341791693385821",
          "topics": "certificate,!packet"
        },
        {
          "i": 0,
          "path": "/certificate",
          "id": "*FD",
          "name": "mm-ipsec134-1791693385821-ca"
        },
        {
          "i": 0,
          "path": "/certificate",
          "id": "*FE",
          "name": "mm-ipsec134-1791693385821-client"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZVl8ZlrfVSEYuJW6mC",
          "name": "cert_export_mm-ipsec134-1791693385821-ca.crt"
        },
        {
          "i": 0,
          "path": "/file",
          "id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxeDbDrKhCaKHbgD7sOdoWuYO",
          "name": "cert_export_mm-ipsec134-1791693385821-client.crt"
        },
        {
          "i": 1,
          "path": "/file",
          "id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIowJMj8dJnxhXmeUL7U",
          "name": "flash/mm-ipsec134-1791693385821-ca.crt",
          "consumedByImport": true
        },
        {
          "i": 1,
          "path": "/certificate",
          "id": "*88",
          "name": "mm-ipsec134-1791693385821-ca"
        },
        {
          "i": 1,
          "path": "/file",
          "id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIC2GcZ52Qj8NXfeoljtGDaUe",
          "name": "flash/mm-ipsec134-1791693385821-client.crt",
          "consumedByImport": true
        },
        {
          "i": 1,
          "path": "/certificate",
          "id": "*89",
          "name": "mm-ipsec134-1791693385821-client"
        },
        {
          "i": 1,
          "path": "/certificate/crl",
          "id": "*7",
          "url": "http://161.104.46.222:18084/crl/253.crl-missing-mm-ipsec134-1791693385821"
        }
      ],
      "settingsRestored": true,
      "endpointClosed": true
    }
  },
  "finalChecks": {
    "publicEndpointPort18084Closed": true,
    "backendHealthy": true,
    "postgresHealthy": true,
    "frontendRunning": true,
    "bothChrRestReachable": true,
    "passwordsUnchanged": true
  },
  "bounds": [
    "Native own CA/client certificates issued on CHR1; only public PEM imported to CHR2 (private-keys-imported0)",
    "Native DER CRL served by an ephemeral Debian HTTP endpoint, exact path only, Content-Length/Connection close; not a product integration or permanent service",
    "Both CA/client dynamic CRL entries ultimately valid/nonexpired/revoked0; native downloader request from CHR2 recorded",
    "Separate static missing URL receives404 from receiver and remains invalid=true/cert=none; valid cached CRLs remain valid",
    "This does not prove IKE refusal when a bound certificate CDP is unavailable, immediate active-session revocation, expired/malformed CRL or hourly refresh",
    "Direct CHR1 CRL URL accessible from Debian but receiver tool/fetch remote-disconnected; exact reason still unknown and direct CHR-to-CHR distribution is not accepted",
    "First cleanup required scoped recovery; subsequent10-collection ID baselines per CHR converged; no global/default logs cleared",
    "CRL settings precisely restored; owned logger/certificates/files/cache removed; flash directory/default/public/metadata/195 route preserved",
    "No application source/runtime changes, no new VPN tunnel, no build/full-regression rerun in this infrastructure acceptance block"
  ],
  "references": [
    "https://manual.mikrotik.com/docs/authentication-authorization-accounting/certificates/",
    "https://manual.mikrotik.com/docs/cli-reference/certificate/crl/download/"
  ]
}