www-ssl is enabled without a certificate

What the audit found

The www-ssl service — the HTTPS version of WebFig, the router's web interface — is enabled under IP → Services, but its Certificate field is set to none. HTTPS needs a certificate to work; without one the service cannot establish a properly authenticated encrypted session, and depending on the RouterOS version it will either refuse connections or present something browsers reject.

The audit reports this as low severity. It is a configuration gap rather than an open door: the service is not leaking anything, it is simply not doing its job, and people who cannot use it tend to fall back to the plain HTTP interface, which does leak.

Why it matters

This finding is about hygiene, not a hole, so it is worth being precise about the risk.

HTTPS does two things: it encrypts the connection, and it lets the browser check that it is talking to the right server. Both depend on a certificate. With none assigned, www-ssl cannot complete a TLS handshake. In practice that means either a connection error in the browser or — on some versions — a session that offers no assurance about who is on the other end.

The practical consequence is that administrators who cannot get HTTPS to work use HTTP on port 80 instead. Plain HTTP sends the router's password in the clear, so anyone on the same network segment (or on the same open WiFi) can read it. A working www-ssl service is what lets you disable plain www with a clear conscience.

Even a self-signed certificate is a large improvement. Your browser will warn once because it does not know the issuer, but after you accept it the connection is encrypted and — if you check the fingerprint — authenticated. If you have your own certificate authority or use Let's Encrypt (RouterOS 7 can obtain a certificate directly), the warning disappears entirely.

What it looks like in Winbox

Open IP → Services. Find the www-ssl row: it is enabled (not greyed out), but the Certificate column is empty or shows none. Compare it with the www row, which is probably enabled too.

System → Certificates shows which certificates exist on the router; if the list is empty or contains only CA certificates, there is nothing for www-ssl to use.

How to fix it

Create a self-signed certificate for the web interface, sign it, and assign it to the service. Under System → Certificates, add a certificate whose common name is the router's name or address as you will type it into the browser, with the key usage marked for TLS server; then use Sign on it without specifying a CA, which makes it self-signed. Signing takes a few seconds on smaller devices, and the certificate is valid for a year by default — choose a longer validity when creating it if you do not want to repeat this annually. Finally, open the www-ssl row under IP → Services and pick the new certificate in its Certificate field.

On RouterOS 7, if the router has a public DNS name and port 80 is reachable from the internet during enrolment, the Enable SSL Certificate action under System → Certificates obtains a Let's Encrypt certificate and assigns it to www-ssl automatically, with no browser warning.

Once HTTPS works, disable the plain www service so passwords never travel unencrypted. Do that last step in Safe Mode if the web interface is your main way in, and only after you have confirmed HTTPS works. Also restrict www-ssl to your management network with the Available From field, as you would for Winbox.

Afterwards, open the router's address over HTTPS in a browser: you should reach the WebFig login page, with a one-time warning if the certificate is self-signed, which you can inspect and accept. Confirm that the www-ssl row now shows the certificate name, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The browser still warns me about the certificate. Is that acceptable?

For a self-signed certificate, yes: the warning means the browser does not know the issuer, not that the connection is insecure. Check the fingerprint once against the one shown under System → Certificates and accept it. If you want no warning, import the certificate into your workstation's trust store or use Let's Encrypt.

I only use Winbox. Can I just disable www-ssl?

Yes. If neither HTTP nor HTTPS is used, disable both under IP → Services. Fewer enabled services means fewer things to worry about. The finding only applies while www-ssl is enabled.

Does the certificate also cover api-ssl?

No, each service has its own Certificate field. If you use api-ssl, assign the same certificate to it in the same way.