denozord/MikrotikManager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 104 Wiki Activity
Files
0cc8fe557296a27410d0064bb58d1991095df3e1
MikrotikManager/docs/ux-ui/acceptance/ipsec-external-crl-ike-2026-10-11.json
T

1167 lines
41 KiB
JSON
Raw Blame History

{
"date": "2026-10-11",
"block": "12.5.135",
"runtime": {
"backend": "ux-log133",
"frontend": "ux-log133"
},
"native": {
"date": "2026-10-11",
"block": "12.5.135",
"name": "mm-ipsec135-1791694089625",
"observations": [
{
"phase": "valid-crl-download",
"rows": [
{
".id": "*D",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:48:14",
"next-update": "2027-10-11 06:48:11"
},
{
".id": "*E",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
]
}
],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true,
"/ip/ipsec/policy": true,
"/ip/ipsec/policy/group": true,
"/ip/ipsec/profile": true,
"/ip/ipsec/proposal": true,
"/ip/ipsec/mode-config": true,
"/ip/pool": true,
"/interface/bridge": true,
"/ipv6/address": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true,
"/ip/ipsec/policy": true,
"/ip/ipsec/policy/group": true,
"/ip/ipsec/profile": true,
"/ip/ipsec/proposal": true,
"/ip/ipsec/mode-config": true,
"/ip/pool": true,
"/interface/bridge": true,
"/ipv6/address": true
}
],
"endpointRequests": [
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 404
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 404
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/259.crl",
"source": "104.165.244.7",
"status": 200
}
],
"distributionUrl": "http://161.104.46.222:18084/crl/259.crl",
"httpControl": {
"origin": "http://194.226.121.150/crl/259.crl",
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec135-1791694089625-ca\nlastUpdate=Oct 11 04:48:11 2026 GMT\nnextUpdate=Oct 11 04:48:11 2027 GMT"
},
"receiverHttpControl": [
{
".section": "0",
"status": "connecting"
},
{
".section": "1",
"code": "200",
"downloaded": "1",
"duration": "1s",
"status": "finished",
"total": "1"
}
],
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"downloadReceipt": {
"automaticDownloadInProgress": true
},
"ike": [
{
"phase": "valid",
"crlBefore": [
{
".id": "*D",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:48:14",
"next-update": "2027-10-11 06:48:11"
},
{
".id": "*E",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-client",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:48:14",
"next-update": "2027-10-11 06:48:11"
}
],
"initiated": true,
"output": "onse 1 [ EF(1/2) ]\n[ENC] received fragment #1 of 2, waiting for complete IKE message\n[NET] received packet: from 104.165.244.7[4500] to 172.19.0.2[4500] (516 bytes)\n[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]\n[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1360 bytes)\n[ENC] parsed IKE_AUTH response 1 [ IDr AUTH CERT N(INIT_CONTACT) CPRP(ADDR MASK DNS DNS DNS DNS) TSi TSr SA ]\n[IKE] received end entity cert \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] using trusted certificate \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] using trusted ca certificate \"CN=mm-ipsec135-1791694089625-server-ca\"\n[CFG] reached self-signed root ca with a path length of 0\n[CFG] checking certificate status of \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] certificate status is not available\n[IKE] authentication of '104.165.244.7' with RSA signature successful\n[CFG] handling INTERNAL_IP4_NETMASK attribute failed\n[IKE] installing DNS server 1.1.1.1 to /etc/resolv.conf\n[IKE] installing DNS server 1.0.0.1 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.8.8 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.4.4 to /etc/resolv.conf\n[IKE] installing new virtual IP 198.18.135.248\n[IKE] IKE_SA lab[1] established between 172.19.0.2[CN=mm-ipsec135-1791694089625-client]...104.165.244.7[104.165.244.7]\n[IKE] scheduling rekeying in 13938s\n[IKE] maximum IKE_SA lifetime 15378s\n[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ\n[IKE] CHILD_SA private{1} established with SPIs c18eab67_i 1c9e2049_o and TS 198.18.135.248/32 === 198.18.135.0/24\ninitiate completed successfully\n",
"established": 1,
"online": true,
"privateIp": "172.19.0.2",
"vip": "198.18.135.248",
"pingAttempts": [
{
"success": true,
"output": "PING 198.18.135.1 (198.18.135.1) from 198.18.135.248 : 56(84) bytes of data.\n64 bytes from 198.18.135.1: icmp_seq=1 ttl=64 time=62.3 ms\n64 bytes from 198.18.135.1: icmp_seq=2 ttl=64 time=62.4 ms\n64 bytes from 198.18.135.1: icmp_seq=3 ttl=64 time=62.4 ms\n\n--- 198.18.135.1 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2004ms\nrtt min/avg/max/mdev = 62.326/62.365/62.416/0.037 ms\n"
}
],
"ping3of3": true
},
{
"phase": "missing",
"crlBefore": [
{
".id": "*D",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-ca",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
},
{
".id": "*E",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
],
"initiated": false,
"output": "able\ninitiate failed: establishing CHILD_SA 'private' failed\n[IKE] initiating IKE_SA lab[1] to 104.165.244.7\n[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]\n[NET] sending packet: from 172.19.0.3[500] to 104.165.244.7[500] (464 bytes)\n[NET] received packet: from 104.165.244.7[500] to 172.19.0.3[500] (437 bytes)\n[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) CERTREQ ]\n[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048\n[IKE] local host is behind NAT, sending keep alives\n[IKE] sending cert request for \"CN=mm-ipsec135-1791694089625-server-ca\"\n[IKE] sending cert request for \"CN=mm-ipsec135-1791694089625-ca\"\n[IKE] authentication of 'CN=mm-ipsec135-1791694089625-client' (myself) with RSA signature successful\n[IKE] sending end entity cert \"CN=mm-ipsec135-1791694089625-client\"\n[IKE] establishing CHILD_SA private{1}\n[ENC] generating IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]\n[ENC] splitting IKE message (1472 bytes) into 2 fragments\n[ENC] generating IKE_AUTH request 1 [ EF(1/2) ]\n[ENC] generating IKE_AUTH request 1 [ EF(2/2) ]\n[NET] sending packet: from 172.19.0.3[4500] to 104.165.244.7[4500] (1236 bytes)\n[NET] sending packet: from 172.19.0.3[4500] to 104.165.244.7[4500] (308 bytes)\n[NET] received packet: from 104.165.244.7[4500] to 172.19.0.3[4500] (288 bytes)\n[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]\n[IKE] received AUTHENTICATION_FAILED notify error\n",
"established": 0,
"online": false,
"privateIp": "172.19.0.3"
},
{
"phase": "recovered",
"crlBefore": [
{
".id": "*D",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:48:26",
"next-update": "2027-10-11 06:48:11"
},
{
".id": "*E",
"url": "http://161.104.46.222:18084/crl/259.crl",
"cert": "mm-ipsec135-1791694089625-client",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:48:26",
"next-update": "2027-10-11 06:48:11"
}
],
"initiated": true,
"output": "onse 1 [ EF(1/2) ]\n[ENC] received fragment #1 of 2, waiting for complete IKE message\n[NET] received packet: from 104.165.244.7[4500] to 172.19.0.4[4500] (500 bytes)\n[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]\n[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1360 bytes)\n[ENC] parsed IKE_AUTH response 1 [ IDr AUTH CERT N(INIT_CONTACT) CPRP(ADDR MASK DNS DNS DNS DNS) TSi TSr SA ]\n[IKE] received end entity cert \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] using trusted certificate \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] using trusted ca certificate \"CN=mm-ipsec135-1791694089625-server-ca\"\n[CFG] reached self-signed root ca with a path length of 0\n[CFG] checking certificate status of \"CN=mm-ipsec135-1791694089625-server\"\n[CFG] certificate status is not available\n[IKE] authentication of '104.165.244.7' with RSA signature successful\n[CFG] handling INTERNAL_IP4_NETMASK attribute failed\n[IKE] installing DNS server 1.1.1.1 to /etc/resolv.conf\n[IKE] installing DNS server 1.0.0.1 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.8.8 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.4.4 to /etc/resolv.conf\n[IKE] installing new virtual IP 198.18.135.248\n[IKE] IKE_SA lab[1] established between 172.19.0.4[CN=mm-ipsec135-1791694089625-client]...104.165.244.7[104.165.244.7]\n[IKE] scheduling rekeying in 13105s\n[IKE] maximum IKE_SA lifetime 14545s\n[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ\n[IKE] CHILD_SA private{1} established with SPIs c8089a63_i f7190def_o and TS 198.18.135.248/32 === 198.18.135.0/24\ninitiate completed successfully\n",
"established": 1,
"online": true,
"privateIp": "172.19.0.4",
"vip": "198.18.135.248",
"pingAttempts": [
{
"success": true,
"output": "PING 198.18.135.1 (198.18.135.1) from 198.18.135.248 : 56(84) bytes of data.\n64 bytes from 198.18.135.1: icmp_seq=1 ttl=64 time=62.3 ms\n64 bytes from 198.18.135.1: icmp_seq=2 ttl=64 time=62.6 ms\n64 bytes from 198.18.135.1: icmp_seq=3 ttl=64 time=62.2 ms\n\n--- 198.18.135.1 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2003ms\nrtt min/avg/max/mdev = 62.189/62.374/62.613/0.177 ms\n"
}
],
"ping3of3": true
}
],
"success": true,
"receiverLogs": [],
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": [],
"/ip/ipsec/policy": [
"*FFFFFF"
],
"/ip/ipsec/policy/group": [
"*2"
],
"/ip/ipsec/profile": [
"*A"
],
"/ip/ipsec/proposal": [
"*0"
],
"/ip/ipsec/mode-config": [
"*1"
],
"/ip/pool": [],
"/interface/bridge": [],
"/ipv6/address": [
"*1",
"*2"
]
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": [],
"/ip/ipsec/policy": [
"*FFFFFF"
],
"/ip/ipsec/policy/group": [
"*2"
],
"/ip/ipsec/profile": [
"*A"
],
"/ip/ipsec/proposal": [
"*0"
],
"/ip/ipsec/mode-config": [
"*1"
],
"/ip/pool": [],
"/interface/bridge": [],
"/ipv6/address": [
"*1",
"*2"
]
}
],
"owned": [
{
"i": 1,
"path": "/system/logging/action",
"id": "*B",
"name": "mmipsec1351791694089625"
},
{
"i": 1,
"path": "/system/logging",
"id": "*14",
"prefix": "mm-ipsec135-1791694089625",
"action": "mmipsec1351791694089625",
"topics": "certificate,!packet"
},
{
"i": 1,
"path": "/system/logging",
"id": "*15",
"prefix": "mm-ipsec135-1791694089625",
"action": "mmipsec1351791694089625",
"topics": "ipsec,!packet"
},
{
"i": 0,
"path": "/certificate",
"id": "*103",
"name": "mm-ipsec135-1791694089625-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*104",
"name": "mm-ipsec135-1791694089625-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM6ty3rbG4XlQZxn5BPPQmDoOhQ2qtY",
"name": "cert_export_mm-ipsec135-1791694089625-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBOZ9ZX2OuTR8DhfzPV3uqeGR4R6fZBtUtdHo",
"name": "cert_export_mm-ipsec135-1791694089625-client.crt"
},
{
"i": 1,
"path": "/file",
"id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxudL5tpxgQP6dpOLJKmB54jHNZl15Eq",
"name": "flash/mm-ipsec135-1791694089625-ca.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*90",
"name": "mm-ipsec135-1791694089625-ca"
},
{
"i": 1,
"path": "/file",
"id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YMAv2Q0x2X6YFUeoCoG4n4X0QYMSX8waJE4",
"name": "flash/mm-ipsec135-1791694089625-client.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*91",
"name": "mm-ipsec135-1791694089625-client"
},
{
"i": 1,
"path": "/certificate",
"id": "*92",
"name": "mm-ipsec135-1791694089625-server-ca"
},
{
"i": 1,
"path": "/certificate",
"id": "*93",
"name": "mm-ipsec135-1791694089625-server"
},
{
"i": 1,
"path": "/file",
"id": "**ATsGNOdfQYW0jGXwAqCzLS04Qt5t2f1xV1cnDEWohFYH1jU6gf3Jz0W5y1iCAbGvU5I8KiGRkjk",
"name": "cert_export_mm-ipsec135-1791694089625-server-ca.crt"
},
{
"i": 1,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBOZ9ZX2OuTR8DhfzPV3uqeGoRyxb9H7dRHRk",
"name": "cert_export_mm-ipsec135-1791694089625-server.crt"
},
{
"i": 1,
"path": "/ip/ipsec/profile",
"id": "*B",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/proposal",
"id": "*1",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/policy/group",
"id": "*3",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/policy",
"id": "*1000000"
},
{
"i": 1,
"path": "/ip/pool",
"id": "*2",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/mode-config",
"id": "*2",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/peer",
"id": "*1",
"name": "mm-ipsec135-1791694089625"
},
{
"i": 1,
"path": "/ip/ipsec/identity",
"id": "*A"
},
{
"i": 1,
"path": "/interface/bridge",
"id": "*6D",
"name": "mm-ipsec135-1791694089625-br"
},
{
"i": 1,
"path": "/ip/address",
"id": "*95"
}
],
"settingsRestored": true,
"dockerCleanup": true,
"endpointClosed": true,
"privateFilesRemoved": true
},
"firstAttempt": {
"date": "2026-10-11",
"block": "12.5.135",
"name": "mm-ipsec135-1791693876403",
"observations": [
{
"phase": "valid-crl-download",
"rows": [
{
".id": "*B",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:44:41",
"next-update": "2027-10-11 06:44:38"
},
{
".id": "*C",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
]
}
],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true,
"/ip/ipsec/policy": true,
"/ip/ipsec/policy/group": true,
"/ip/ipsec/profile": true,
"/ip/ipsec/proposal": true,
"/ip/ipsec/mode-config": true,
"/ip/pool": true,
"/interface/bridge": true,
"/ipv6/address": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true,
"/ip/ipsec/policy": true,
"/ip/ipsec/policy/group": true,
"/ip/ipsec/profile": true,
"/ip/ipsec/proposal": true,
"/ip/ipsec/mode-config": true,
"/ip/pool": true,
"/interface/bridge": true,
"/ipv6/address": true
}
],
"endpointRequests": [
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 404
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 404
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/257.crl",
"source": "104.165.244.7",
"status": 200
}
],
"distributionUrl": "http://161.104.46.222:18084/crl/257.crl",
"httpControl": {
"origin": "http://194.226.121.150/crl/257.crl",
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec135-1791693876403-ca\nlastUpdate=Oct 11 04:44:38 2026 GMT\nnextUpdate=Oct 11 04:44:38 2027 GMT"
},
"receiverHttpControl": [
{
".section": "0",
"status": "connecting"
},
{
".section": "1",
"code": "200",
"downloaded": "1",
"duration": "1s",
"status": "finished",
"total": "1"
}
],
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"downloadReceipt": {
"automaticDownloadInProgress": true
},
"ike": [
{
"phase": "valid",
"crlBefore": [
{
".id": "*B",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:44:41",
"next-update": "2027-10-11 06:44:38"
},
{
".id": "*C",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-client",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:44:42",
"next-update": "2027-10-11 06:44:38"
}
],
"initiated": true,
"output": "onse 1 [ EF(1/2) ]\n[ENC] received fragment #1 of 2, waiting for complete IKE message\n[NET] received packet: from 104.165.244.7[4500] to 172.19.0.2[4500] (516 bytes)\n[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]\n[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1360 bytes)\n[ENC] parsed IKE_AUTH response 1 [ IDr AUTH CERT N(INIT_CONTACT) CPRP(ADDR MASK DNS DNS DNS DNS) TSi TSr SA ]\n[IKE] received end entity cert \"CN=mm-ipsec135-1791693876403-server\"\n[CFG] using trusted certificate \"CN=mm-ipsec135-1791693876403-server\"\n[CFG] using trusted ca certificate \"CN=mm-ipsec135-1791693876403-server-ca\"\n[CFG] reached self-signed root ca with a path length of 0\n[CFG] checking certificate status of \"CN=mm-ipsec135-1791693876403-server\"\n[CFG] certificate status is not available\n[IKE] authentication of '104.165.244.7' with RSA signature successful\n[CFG] handling INTERNAL_IP4_NETMASK attribute failed\n[IKE] installing DNS server 1.1.1.1 to /etc/resolv.conf\n[IKE] installing DNS server 1.0.0.1 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.8.8 to /etc/resolv.conf\n[IKE] installing DNS server 8.8.4.4 to /etc/resolv.conf\n[IKE] installing new virtual IP 198.18.135.249\n[IKE] IKE_SA lab[1] established between 172.19.0.2[CN=mm-ipsec135-1791693876403-client]...104.165.244.7[104.165.244.7]\n[IKE] scheduling rekeying in 13725s\n[IKE] maximum IKE_SA lifetime 15165s\n[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ\n[IKE] CHILD_SA private{1} established with SPIs c0b61bff_i ea23b3b9_o and TS 198.18.135.249/32 === 198.18.135.0/24\ninitiate completed successfully\n",
"established": 1,
"online": true,
"privateIp": "172.19.0.2",
"vip": "198.18.135.249",
"pingAttempts": [
{
"success": true,
"output": "PING 198.18.135.1 (198.18.135.1) from 198.18.135.249 : 56(84) bytes of data.\n64 bytes from 198.18.135.1: icmp_seq=1 ttl=64 time=62.4 ms\n64 bytes from 198.18.135.1: icmp_seq=2 ttl=64 time=62.2 ms\n64 bytes from 198.18.135.1: icmp_seq=3 ttl=64 time=62.2 ms\n\n--- 198.18.135.1 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2003ms\nrtt min/avg/max/mdev = 62.197/62.294/62.444/0.107 ms\n"
}
],
"ping3of3": true
},
{
"phase": "missing",
"crlBefore": [
{
".id": "*B",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-ca",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
},
{
".id": "*C",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
],
"initiated": false,
"output": "able\ninitiate failed: establishing CHILD_SA 'private' failed\n[IKE] initiating IKE_SA lab[1] to 104.165.244.7\n[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]\n[NET] sending packet: from 172.19.0.3[500] to 104.165.244.7[500] (464 bytes)\n[NET] received packet: from 104.165.244.7[500] to 172.19.0.3[500] (437 bytes)\n[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) CERTREQ ]\n[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048\n[IKE] local host is behind NAT, sending keep alives\n[IKE] sending cert request for \"CN=mm-ipsec135-1791693876403-server-ca\"\n[IKE] sending cert request for \"CN=mm-ipsec135-1791693876403-ca\"\n[IKE] authentication of 'CN=mm-ipsec135-1791693876403-client' (myself) with RSA signature successful\n[IKE] sending end entity cert \"CN=mm-ipsec135-1791693876403-client\"\n[IKE] establishing CHILD_SA private{1}\n[ENC] generating IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]\n[ENC] splitting IKE message (1472 bytes) into 2 fragments\n[ENC] generating IKE_AUTH request 1 [ EF(1/2) ]\n[ENC] generating IKE_AUTH request 1 [ EF(2/2) ]\n[NET] sending packet: from 172.19.0.3[4500] to 104.165.244.7[4500] (1236 bytes)\n[NET] sending packet: from 172.19.0.3[4500] to 104.165.244.7[4500] (308 bytes)\n[NET] received packet: from 104.165.244.7[4500] to 172.19.0.3[4500] (240 bytes)\n[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]\n[IKE] received AUTHENTICATION_FAILED notify error\n",
"established": 0,
"online": false,
"privateIp": "172.19.0.3"
},
{
"phase": "recovered",
"crlBefore": [
{
".id": "*B",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:44:54",
"next-update": "2027-10-11 06:44:38"
},
{
".id": "*C",
"url": "http://161.104.46.222:18084/crl/257.crl",
"cert": "mm-ipsec135-1791693876403-client",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:44:54",
"next-update": "2027-10-11 06:44:38"
}
],
"initiated": false,
"output": "vailable\nplugin 'gmp': failed to load - gmp_plugin_create not found and no plugin file available\nplugin 'curve25519': failed to load - curve25519_plugin_create not found and no plugin file available\nplugin 'chapoly': failed to load - chapoly_plugin_create not found and no plugin file available\nplugin 'xcbc': failed to load - xcbc_plugin_create not found and no plugin file available\nplugin 'cmac': failed to load - cmac_plugin_create not found and no plugin file available\nplugin 'hmac': failed to load - hmac_plugin_create not found and no plugin file available\nplugin 'kdf': failed to load - kdf_plugin_create not found and no plugin file available\nplugin 'ctr': failed to load - ctr_plugin_create not found and no plugin file available\nplugin 'ccm': failed to load - ccm_plugin_create not found and no plugin file available\nplugin 'curl': failed to load - curl_plugin_create not found and no plugin file available\ninitiate failed: CHILD_SA 'private' not established after 30000ms\n[IKE] initiating IKE_SA lab[1] to 104.165.244.7\n[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]\n[NET] sending packet: from 172.19.0.4[500] to 104.165.244.7[500] (464 bytes)\n[IKE] retransmit 1 of request with message ID 0\n[NET] sending packet: from 172.19.0.4[500] to 104.165.244.7[500] (464 bytes)\n[IKE] retransmit 2 of request with message ID 0\n[NET] sending packet: from 172.19.0.4[500] to 104.165.244.7[500] (464 bytes)\n[IKE] retransmit 3 of request with message ID 0\n[NET] sending packet: from 172.19.0.4[500] to 104.165.244.7[500] (464 bytes)\n",
"established": 0,
"online": false,
"privateIp": "172.19.0.4"
}
],
"error": "Valid control failed: recovered\n\n1 !== 0\n",
"receiverLogs": [
{
"message": "mm-ipsec135-1791693876403: failed to validate path: CRL not found crl not found for: \"CN=mm-ipsec135-1791693876403-client\"",
"time": "2026-10-11 06:44:53",
"topics": "ipsec"
},
{
"message": "mm-ipsec135-1791693876403: can't verify peer's certificate from store",
"time": "2026-10-11 06:44:53",
"topics": "ipsec,error"
},
{
"message": "mm-ipsec135-1791693876403: reply notify: AUTHENTICATION_FAILED",
"time": "2026-10-11 06:44:53",
"topics": "ipsec"
},
{
"message": "mm-ipsec135-1791693876403: adding notify: AUTHENTICATION_FAILED",
"time": "2026-10-11 06:44:53",
"topics": "ipsec"
},
{
"message": "mm-ipsec135-1791693876403: crl update: completed for mm-ipsec135-1791693876403-ca",
"time": "2026-10-11 06:44:54",
"topics": "certificate,info"
},
{
"message": "mm-ipsec135-1791693876403: crl update: completed for mm-ipsec135-1791693876403-client",
"time": "2026-10-11 06:44:54",
"topics": "certificate,info"
},
{
"message": "mm-ipsec135-1791693876403: trust store updated: ipsec",
"time": "2026-10-11 06:44:55",
"topics": "certificate,debug"
}
],
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": [],
"/ip/ipsec/policy": [
"*FFFFFF"
],
"/ip/ipsec/policy/group": [
"*2"
],
"/ip/ipsec/profile": [
"*A"
],
"/ip/ipsec/proposal": [
"*0"
],
"/ip/ipsec/mode-config": [
"*1"
],
"/ip/pool": [],
"/interface/bridge": [],
"/ipv6/address": [
"*1",
"*2"
]
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": [],
"/ip/ipsec/policy": [
"*FFFFFF"
],
"/ip/ipsec/policy/group": [
"*2"
],
"/ip/ipsec/profile": [
"*A"
],
"/ip/ipsec/proposal": [
"*0"
],
"/ip/ipsec/mode-config": [
"*1"
],
"/ip/pool": [],
"/interface/bridge": [],
"/ipv6/address": [
"*1",
"*2"
]
}
],
"owned": [
{
"i": 1,
"path": "/system/logging/action",
"id": "*A",
"name": "mmipsec1351791693876403"
},
{
"i": 1,
"path": "/system/logging",
"id": "*12",
"prefix": "mm-ipsec135-1791693876403",
"action": "mmipsec1351791693876403",
"topics": "certificate,!packet"
},
{
"i": 1,
"path": "/system/logging",
"id": "*13",
"prefix": "mm-ipsec135-1791693876403",
"action": "mmipsec1351791693876403",
"topics": "ipsec,!packet"
},
{
"i": 0,
"path": "/certificate",
"id": "*101",
"name": "mm-ipsec135-1791693876403-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*102",
"name": "mm-ipsec135-1791693876403-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM6ty3rbG4XlQTJcqlPi2SOwme59TfA",
"name": "cert_export_mm-ipsec135-1791693876403-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBOZ9ZX2OuTR8DCVhMHG4LJM9MHEs6ka2TXiG",
"name": "cert_export_mm-ipsec135-1791693876403-client.crt"
},
{
"i": 1,
"path": "/file",
"id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxudL5tpxgQP6dikB4umTgkuPlWQ7i0S",
"name": "flash/mm-ipsec135-1791693876403-ca.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*8C",
"name": "mm-ipsec135-1791693876403-ca"
},
{
"i": 1,
"path": "/file",
"id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YMAv2Q0x2X6XkKMkz0PZSAFIGgZ05pUADeW",
"name": "flash/mm-ipsec135-1791693876403-client.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*8D",
"name": "mm-ipsec135-1791693876403-client"
},
{
"i": 1,
"path": "/certificate",
"id": "*8E",
"name": "mm-ipsec135-1791693876403-server-ca"
},
{
"i": 1,
"path": "/certificate",
"id": "*8F",
"name": "mm-ipsec135-1791693876403-server"
},
{
"i": 1,
"path": "/file",
"id": "**ATsGNOdfQYW0jGXwAqCzLS04Qt5t2f1xV1cnDEWohFYH1jU67H6k0CZYyKLX0hLlupJ4mdAgo0y",
"name": "cert_export_mm-ipsec135-1791693876403-server-ca.crt"
},
{
"i": 1,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBOZ9ZX2OuTR8DCVhMHG4LJMWjp5ngpoB1BsC",
"name": "cert_export_mm-ipsec135-1791693876403-server.crt"
},
{
"i": 1,
"path": "/ip/ipsec/profile",
"id": "*B",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/proposal",
"id": "*1",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/policy/group",
"id": "*3",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/policy",
"id": "*1000000"
},
{
"i": 1,
"path": "/ip/pool",
"id": "*1",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/mode-config",
"id": "*2",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/peer",
"id": "*1",
"name": "mm-ipsec135-1791693876403"
},
{
"i": 1,
"path": "/ip/ipsec/identity",
"id": "*A"
},
{
"i": 1,
"path": "/interface/bridge",
"id": "*6C",
"name": "mm-ipsec135-1791693876403-br"
},
{
"i": 1,
"path": "/ip/address",
"id": "*94"
}
],
"settingsRestored": true,
"dockerCleanup": true,
"endpointClosed": true,
"privateFilesRemoved": true
},
"endpointPortClosed": true,
"bounds": [
"Own client CA/certificate from CHR1, public imports on CHR2; separate own responder CA/server key created natively on CHR2",
"Three distinct Linux containers/addresses reserved across phases; private client credentials only in scoped0700/0600 files, then removed",
"CRL-use/download true; certificate-bound exact CDP URL404 with own cache flushed after ownership preflight, invalid caches confirmed before IKE",
"Missing CRL explicitly AUTHENTICATION_FAILED in both runs; scoped RouterOS CRL not found captured in first run; final buffer retains recovery logs; API online false",
"Restored signed CRL cache and independent positive control IKE/Ping3of3 accepted in final run",
"First run recovered IKE_INIT timeout retained, exact transport cause unknown; not treated as CRL refusal or recovery success",
"No immediate revocation of already established sessions, other client OS, sustained throughput/SLA, expired/malformed CRL acceptance",
"18 collection ID baselines per CHR converged; settings exact restoration, Docker/keys/logger/cert/policy/pool/bridge/address/endpoint cleanup",
"Only selected auth/CRL metadata logs persisted; packet/crypto dumps excluded; passwords unchanged",
"No application source/runtime/UI changes, no build repetition"
],
"references": [
"https://manual.mikrotik.com/docs/authentication-authorization-accounting/certificates/"
]
}
Reference in new issue View Git Blame Copy Permalink