CloudLabBox
Try the free demo

MikroTik MTCSE lab 7 of 10

Certificates and PKI: your own CA, HTTPS, SSH keys and SSH tunnels

Fernvale's NOC wants every management session encrypted and verifiable. Build Fernvale's own certificate authority on the Harbourside router, serve WebFig over HTTPS with a certificate that a client can verify, give the NOC engineer a key-only SSH account, and reach a switch's web page on an isolated management network through an SSH tunnel.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 07 - Certificates and PKI - your own CA HTTPS SSH keys and SSH tunnels

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

Fernvale's NOC wants every management session to be encrypted and verifiable: no clicking through browser warnings, no shared passwords typed into SSH. You'll make the Harbourside router EDGE the home of Fernvale's own certificate authority, serve WebFig over HTTPS with a certificate issued by it, give the NOC engineer an SSH account that accepts only a key, and use SSH to reach a switch whose management network the firewall keeps closed to everyone but EDGE.

DeviceAddressRole
EDGEether1 10.10.10.1/24 (NOC LAN) · ether2 172.16.99.1/24 (switch management)router and CA
SW172.16.99.2/24a switch's WebFig, forwarding to it is blocked
AUD10.10.10.30/24an auditor's PC (RouterOS) that checks certificates
NOC (Linux)10.10.10.10/24the engineer's workstation

What you’ll practise

  • Explain symmetric and asymmetric cryptography, hashes, signatures and how a PKI uses them
  • Create a CA and issue a server certificate on RouterOS, and export the CA certificate
  • Serve WebFig over HTTPS and verify it from a client that trusts the CA
  • Log in with an SSH key instead of a password
  • Forward a local port through SSH to reach a network the firewall otherwise blocks

The tasks

  1. Address the NOC workstation
  2. The ideas behind certificates
  3. Build the CA and a server certificate
  4. WebFig over HTTPS, verified
  5. A key-only SSH account for the engineer
  6. Reach the switch through an SSH tunnel

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Certificates and PKI - your own CA HTTPS SSH keys and SSH tunnels4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.EDGESWAUDNOCNOC-LANether1ether1eth0ether2ether1
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE ether1 to NOC-LAN (network)
  • AUD ether1 to NOC-LAN (network)
  • NOC eth0 to NOC-LAN (network)
  • EDGE ether2 to SW ether1
Nodes in Certificates and PKI: your own CA, HTTPS, SSH keys and SSH tunnels, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
EDGEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
SWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
AUDMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
NOCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 07 - Certificates and PKI - your own CA HTTPS SSH keys and SSH tunnels and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.