denozord/MikrotikManager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 104 Wiki Activity
Files
37a9c828d30080f1ccc98e10b4e7a0791e57bfb4
MikrotikManager/docs/ux-ui/acceptance/ipsec-external-crl-download-2026-10-11.json
T

1320 lines
38 KiB
JSON
Raw Blame History

{
"date": "2026-10-11",
"block": "12.5.134",
"runtime": {
"backend": "ux-log133",
"frontend": "ux-log133"
},
"native": {
"date": "2026-10-11",
"block": "12.5.134",
"name": "mm-ipsec134-1791693461031",
"observations": [
{
"phase": "valid-crl-download",
"rows": [
{
".id": "*8",
"url": "http://161.104.46.222:18084/crl/255.crl",
"cert": "mm-ipsec134-1791693461031-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:37:44",
"next-update": "2027-10-11 06:37:42"
},
{
".id": "*9",
"url": "http://161.104.46.222:18084/crl/255.crl",
"cert": "mm-ipsec134-1791693461031-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
]
},
{
"phase": "missing-crl-url",
"rows": [
{
".id": "*8",
"url": "http://161.104.46.222:18084/crl/255.crl",
"cert": "mm-ipsec134-1791693461031-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:37:44",
"next-update": "2027-10-11 06:37:42"
},
{
".id": "*9",
"url": "http://161.104.46.222:18084/crl/255.crl",
"cert": "mm-ipsec134-1791693461031-client",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:37:45",
"next-update": "2027-10-11 06:37:42"
},
{
".id": "*A",
"url": "http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
"cert": "none",
"invalid": "true",
"dynamic": "false",
"revoked": "unknown"
}
]
}
],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
}
],
"endpointRequests": [
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl-missing-mm-ipsec134-1791693461031",
"source": "172.18.0.1",
"status": 404
},
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/255.crl-missing-mm-ipsec134-1791693461031",
"source": "104.165.244.7",
"status": 404
}
],
"distributionUrl": "http://161.104.46.222:18084/crl/255.crl",
"httpControl": {
"origin": "http://194.226.121.150/crl/255.crl",
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec134-1791693461031-ca\nlastUpdate=Oct 11 04:37:42 2026 GMT\nnextUpdate=Oct 11 04:37:42 2027 GMT"
},
"receiverHttpControl": [
{
".section": "0",
"status": "connecting"
},
{
".section": "1",
"code": "200",
"downloaded": "1",
"duration": "1s",
"status": "finished",
"total": "1"
}
],
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"downloadReceipt": {
"automaticDownloadInProgress": true
},
"missingHttpStatus": 404,
"negativeDownloadReceipt": {
"automaticDownloadInProgress": true
},
"receiverMissingRequestObserved": true,
"success": true,
"receiverLogs": [
{
"message": "mm-ipsec134-1791693461031: looking for CRLs in mm-ipsec134-1791693461031-ca",
"time": "2026-10-11 06:37:44",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: found CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:44",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: start CRL update",
"time": "2026-10-11 06:37:44",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:44",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: new fingerprint [hash]",
"time": "2026-10-11 06:37:44",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: completed for mm-ipsec134-1791693461031-ca",
"time": "2026-10-11 06:37:44",
"topics": "certificate,info"
},
{
"message": "mm-ipsec134-1791693461031: looking for CRLs in mm-ipsec134-1791693461031-client",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: found CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: start CRL update",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: unchanged",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: new fingerprint [hash]",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: completed for mm-ipsec134-1791693461031-client",
"time": "2026-10-11 06:37:45",
"topics": "certificate,info"
},
{
"message": "mm-ipsec134-1791693461031: start CRL update",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: unchanged",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: crl update: unchanged",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: updating CRL: http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
"time": "2026-10-11 06:37:45",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693461031: CRL fetch failed: http code: 404 for: http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031",
"time": "2026-10-11 06:37:45",
"topics": "certificate,error"
}
],
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": []
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": []
}
],
"owned": [
{
"i": 1,
"path": "/system/logging/action",
"id": "*9",
"name": "mmipsec1341791693461031"
},
{
"i": 1,
"path": "/system/logging",
"id": "*11",
"prefix": "mm-ipsec134-1791693461031",
"action": "mmipsec1341791693461031",
"topics": "certificate,!packet"
},
{
"i": 0,
"path": "/certificate",
"id": "*FF",
"name": "mm-ipsec134-1791693461031-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*100",
"name": "mm-ipsec134-1791693461031-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZXPMjI8887qz45YyIe",
"name": "cert_export_mm-ipsec134-1791693461031-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxeLKU4HEAuyinq4lwqRqRQ4C",
"name": "cert_export_mm-ipsec134-1791693461031-client.crt"
},
{
"i": 1,
"path": "/file",
"id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIoxxasetmQdJxwQXCdw",
"name": "flash/mm-ipsec134-1791693461031-ca.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*8A",
"name": "mm-ipsec134-1791693461031-ca"
},
{
"i": 1,
"path": "/file",
"id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIC9zsm1ZP3mojpWSqBhI860S",
"name": "flash/mm-ipsec134-1791693461031-client.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*8B",
"name": "mm-ipsec134-1791693461031-client"
},
{
"i": 1,
"path": "/certificate/crl",
"id": "*A",
"url": "http://161.104.46.222:18084/crl/255.crl-missing-mm-ipsec134-1791693461031"
}
],
"settingsRestored": true,
"endpointClosed": true
},
"initialAttempts": {
"first": {
"protocol": {
"date": "2026-10-11",
"block": "12.5.134",
"name": "mm-ipsec134-1791692971804",
"observations": [],
"cleanup": [],
"distributionUrl": "http://194.226.121.150/crl/247.crl",
"httpControl": {
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec134-1791692971804-ca\nlastUpdate=Oct 11 04:29:32 2026 GMT\nnextUpdate=Oct 11 04:29:32 2027 GMT"
},
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"error": "RouterOS API error 400 on /certificate/crl/download: {\"detail\":\"failure: CRL download in progress\",\"error\":400,\"message\":\"Bad Request\"}"
},
"cleanupError": "Fixture ownership changed: RouterOS consumed uploaded public certificate files after import",
"recovery": {
"name": "mm-ipsec134-1791692971804",
"checks": [
{
"serverId": 2,
"certificates": 0,
"crls": 0,
"ownedFilesRemoved": 0,
"otherFilesPreserved": true,
"settingsRestored": true
},
{
"serverId": 1,
"certificates": 0,
"crls": 0,
"ownedFilesRemoved": 2,
"otherFilesPreserved": true,
"settingsRestored": true
}
]
}
},
"second": {
"date": "2026-10-11",
"block": "12.5.134",
"name": "mm-ipsec134-1791693116777",
"observations": [
{
"phase": "valid-crl-download",
"rows": [
{
".id": "*3",
"url": "http://194.226.121.150/crl/249.crl",
"cert": "mm-ipsec134-1791693116777-ca",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
},
{
".id": "*4",
"url": "http://194.226.121.150/crl/249.crl",
"cert": "mm-ipsec134-1791693116777-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
]
}
],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
}
],
"distributionUrl": "http://194.226.121.150/crl/249.crl",
"httpControl": {
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec134-1791693116777-ca\nlastUpdate=Oct 11 04:31:58 2026 GMT\nnextUpdate=Oct 11 04:31:58 2027 GMT"
},
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"downloadReceipt": {
"automaticDownloadInProgress": true
},
"error": "Valid external CRL did not load",
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": []
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": []
}
],
"owned": [
{
"i": 0,
"path": "/certificate",
"id": "*F9",
"name": "mm-ipsec134-1791693116777-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*FA",
"name": "mm-ipsec134-1791693116777-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZSOF4mBUsI7ufoMjjA",
"name": "cert_export_mm-ipsec134-1791693116777-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxdxntIScRSyOZNg9iRz3PLyG",
"name": "cert_export_mm-ipsec134-1791693116777-client.crt"
},
{
"i": 1,
"path": "/file",
"id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIoswTE8x9AnatY9Ky4S",
"name": "flash/mm-ipsec134-1791693116777-ca.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*86",
"name": "mm-ipsec134-1791693116777-ca"
},
{
"i": 1,
"path": "/file",
"id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIBmTI0CxfbmUVN7qbnEV61uW",
"name": "flash/mm-ipsec134-1791693116777-client.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*87",
"name": "mm-ipsec134-1791693116777-client"
}
],
"settingsRestored": true
},
"third": {
"date": "2026-10-11",
"block": "12.5.134",
"name": "mm-ipsec134-1791693224865",
"observations": [],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
}
],
"distributionUrl": "http://194.226.121.150/crl/251.crl",
"httpControl": {
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec134-1791693224865-ca\nlastUpdate=Oct 11 04:33:45 2026 GMT\nnextUpdate=Oct 11 04:33:45 2027 GMT"
},
"receiverHttpControl": {
"error": "RouterOS API error 400 on /tool/fetch: {\"detail\":\"failure: remote disconnected while in HTTP exchange\",\"error\":400,\"message\":\"Bad Request\"}"
},
"error": "RouterOS API error 400 on /tool/fetch: {\"detail\":\"failure: remote disconnected while in HTTP exchange\",\"error\":400,\"message\":\"Bad Request\"}",
"receiverLogs": [],
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": []
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": []
}
],
"owned": [
{
"i": 1,
"path": "/system/logging/action",
"id": "*7",
"name": "mmipsec1341791693224865"
},
{
"i": 1,
"path": "/system/logging",
"id": "*F",
"prefix": "mm-ipsec134-1791693224865",
"action": "mmipsec1341791693224865",
"topics": "certificate,!packet"
},
{
"i": 0,
"path": "/certificate",
"id": "*FB",
"name": "mm-ipsec134-1791693224865-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*FC",
"name": "mm-ipsec134-1791693224865-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZU3gID26txDz338Lv2",
"name": "cert_export_mm-ipsec134-1791693224865-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxe5cpPdnTygqIZnU3vdtSBBk",
"name": "cert_export_mm-ipsec134-1791693224865-client.crt"
}
]
},
"fourth": {
"date": "2026-10-11",
"block": "12.5.134",
"name": "mm-ipsec134-1791693385821",
"observations": [
{
"phase": "valid-crl-download",
"rows": [
{
".id": "*5",
"url": "http://161.104.46.222:18084/crl/253.crl",
"cert": "mm-ipsec134-1791693385821-ca",
"invalid": "false",
"expired": "false",
"dynamic": "true",
"revoked": "0",
"last-update": "2026-10-11 06:36:29",
"next-update": "2027-10-11 06:36:27"
},
{
".id": "*6",
"url": "http://161.104.46.222:18084/crl/253.crl",
"cert": "mm-ipsec134-1791693385821-client",
"invalid": "true",
"dynamic": "true",
"revoked": "unknown"
}
]
}
],
"cleanup": [
{
"serverId": 1,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
},
{
"serverId": 2,
"/certificate": true,
"/certificate/crl": true,
"/file": true,
"/system/logging": true,
"/system/logging/action": true,
"/ip/ipsec/identity": true,
"/ip/ipsec/peer": true,
"/ip/address": true,
"/ip/route": true,
"/ip/firewall/nat": true
}
],
"endpointRequests": [
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl-missing-mm-ipsec134-1791693385821",
"source": "172.18.0.1",
"status": 404
},
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl",
"source": "104.165.244.7",
"status": 200
},
{
"method": "GET",
"path": "/crl/253.crl-missing-mm-ipsec134-1791693385821",
"source": "104.165.244.7",
"status": 404
}
],
"distributionUrl": "http://161.104.46.222:18084/crl/253.crl",
"httpControl": {
"origin": "http://194.226.121.150/crl/253.crl",
"status": 200,
"bytes": 423,
"parsed": "issuer=CN = mm-ipsec134-1791693385821-ca\nlastUpdate=Oct 11 04:36:27 2026 GMT\nnextUpdate=Oct 11 04:36:27 2027 GMT"
},
"receiverHttpControl": [
{
".section": "0",
"status": "connecting"
},
{
".section": "1",
"code": "200",
"downloaded": "1",
"duration": "1s",
"status": "finished",
"total": "1"
}
],
"settingsBefore": {
"builtin-trust-store": "default",
"crl-download": "false",
"crl-store": "ram",
"crl-use": "false",
"current-defaults": "fetch,mqtt,email,netwatch,container,lora,wiliot,dns,www,reverse-proxy"
},
"imports": [
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
],
[
{
"certificates-imported": "1",
"decryption-failures": "0",
"files-imported": "0",
"keys-with-no-certificate": "0",
"private-keys-imported": "0"
}
]
],
"downloadReceipt": {
"automaticDownloadInProgress": true
},
"missingHttpStatus": 404,
"error": "RouterOS API error 400 on /certificate/crl/download: {\"detail\":\"failure: CRL download in progress\",\"error\":400,\"message\":\"Bad Request\"}",
"receiverLogs": [
{
"message": "mm-ipsec134-1791693385821: looking for CRLs in mm-ipsec134-1791693385821-ca",
"time": "2026-10-11 06:36:29",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: found CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:29",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: start CRL update",
"time": "2026-10-11 06:36:29",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:29",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: new fingerprint [hash]",
"time": "2026-10-11 06:36:29",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: completed for mm-ipsec134-1791693385821-ca",
"time": "2026-10-11 06:36:29",
"topics": "certificate,info"
},
{
"message": "mm-ipsec134-1791693385821: looking for CRLs in mm-ipsec134-1791693385821-client",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: found CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: start CRL update",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: unchanged",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: new fingerprint [hash]",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: completed for mm-ipsec134-1791693385821-client",
"time": "2026-10-11 06:36:30",
"topics": "certificate,info"
},
{
"message": "mm-ipsec134-1791693385821: start CRL update",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: crl update: unchanged",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
},
{
"message": "mm-ipsec134-1791693385821: updating CRL: http://161.104.46.222:18084/crl/253.crl",
"time": "2026-10-11 06:36:30",
"topics": "certificate,debug"
}
],
"baselineIds": [
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*1"
],
"/ip/route": [
"*80000003",
"*80000004",
"*80000005",
"*20145010"
],
"/ip/firewall/nat": []
},
{
"/certificate": [],
"/certificate/crl": [],
"/file": [
"**Qb24a2KNOW6Ay8FA4",
"**NQMkAHKnbvKDA",
"**YHreAtYW0Rzfws6wJ5xXOmqd4"
],
"/system/logging": [
"*1",
"*2",
"*3",
"*4"
],
"/system/logging/action": [
"*0",
"*1",
"*2",
"*3"
],
"/ip/ipsec/identity": [],
"/ip/ipsec/peer": [],
"/ip/address": [
"*2",
"*3"
],
"/ip/route": [
"*80000003",
"*80000005",
"*20145020",
"*80000004",
"*20145010"
],
"/ip/firewall/nat": []
}
],
"owned": [
{
"i": 1,
"path": "/system/logging/action",
"id": "*8",
"name": "mmipsec1341791693385821"
},
{
"i": 1,
"path": "/system/logging",
"id": "*10",
"prefix": "mm-ipsec134-1791693385821",
"action": "mmipsec1341791693385821",
"topics": "certificate,!packet"
},
{
"i": 0,
"path": "/certificate",
"id": "*FD",
"name": "mm-ipsec134-1791693385821-ca"
},
{
"i": 0,
"path": "/certificate",
"id": "*FE",
"name": "mm-ipsec134-1791693385821-client"
},
{
"i": 0,
"path": "/file",
"id": "**1y5Uv8TOn0KeFnHiXMCSEY2IH2f6ivZC5swWM4T97U63CLv5ZVl8ZlrfVSEYuJW6mC",
"name": "cert_export_mm-ipsec134-1791693385821-ca.crt"
},
{
"i": 0,
"path": "/file",
"id": "**9EMwBnKnPqw5n57GAxAb7nSD0qHN74DT6KDBONkUvKBgLaDxeDbDrKhCaKHbgD7sOdoWuYO",
"name": "cert_export_mm-ipsec134-1791693385821-client.crt"
},
{
"i": 1,
"path": "/file",
"id": "**1WhesBaogmIH5vaWFLu8nVJ1uluxuauGxSSTYDGIowJMj8dJnxhXmeUL7U",
"name": "flash/mm-ipsec134-1791693385821-ca.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*88",
"name": "mm-ipsec134-1791693385821-ca"
},
{
"i": 1,
"path": "/file",
"id": "**79zDGTtNvvf2oYBf9lo4MhIGmL90YAlqQhniugCIC2GcZ52Qj8NXfeoljtGDaUe",
"name": "flash/mm-ipsec134-1791693385821-client.crt",
"consumedByImport": true
},
{
"i": 1,
"path": "/certificate",
"id": "*89",
"name": "mm-ipsec134-1791693385821-client"
},
{
"i": 1,
"path": "/certificate/crl",
"id": "*7",
"url": "http://161.104.46.222:18084/crl/253.crl-missing-mm-ipsec134-1791693385821"
}
],
"settingsRestored": true,
"endpointClosed": true
}
},
"finalChecks": {
"publicEndpointPort18084Closed": true,
"backendHealthy": true,
"postgresHealthy": true,
"frontendRunning": true,
"bothChrRestReachable": true,
"passwordsUnchanged": true
},
"bounds": [
"Native own CA/client certificates issued on CHR1; only public PEM imported to CHR2 (private-keys-imported0)",
"Native DER CRL served by an ephemeral Debian HTTP endpoint, exact path only, Content-Length/Connection close; not a product integration or permanent service",
"Both CA/client dynamic CRL entries ultimately valid/nonexpired/revoked0; native downloader request from CHR2 recorded",
"Separate static missing URL receives404 from receiver and remains invalid=true/cert=none; valid cached CRLs remain valid",
"This does not prove IKE refusal when a bound certificate CDP is unavailable, immediate active-session revocation, expired/malformed CRL or hourly refresh",
"Direct CHR1 CRL URL accessible from Debian but receiver tool/fetch remote-disconnected; exact reason still unknown and direct CHR-to-CHR distribution is not accepted",
"First cleanup required scoped recovery; subsequent10-collection ID baselines per CHR converged; no global/default logs cleared",
"CRL settings precisely restored; owned logger/certificates/files/cache removed; flash directory/default/public/metadata/195 route preserved",
"No application source/runtime changes, no new VPN tunnel, no build/full-regression rerun in this infrastructure acceptance block"
],
"references": [
"https://manual.mikrotik.com/docs/authentication-authorization-accounting/certificates/",
"https://manual.mikrotik.com/docs/cli-reference/certificate/crl/download/"
]
}
Reference in new issue View Git Blame Copy Permalink