From: vados-dev <192440777+vados-dev@users.noreply.github.com>
Date: Wed, 15 Apr 2026 19:00:03 +0000 (+0300)
Subject: Autocommit in repo: ros.vados.ru, generated by owner: root, in 22:00:02 15.04.2026.
X-Git-Url: https://git.vados.ru/gitweb.cgi?a=commitdiff_plain;h=efe032c8ae523e6a8787242b87040819119c900c;p=Mikrotiks%2Fros.vados.ru.git

Autocommit in repo: ros.vados.ru, generated by owner: root, in 22:00:02 15.04.2026.
---

diff --git a/html/AM-CustomCerts.rsc b/html/AM-CustomCerts.rsc
index f15bca982..22433cb42 100644
--- a/html/AM-CustomCerts.rsc
+++ b/html/AM-CustomCerts.rsc
@@ -1,10 +1,10 @@
 #!rsc by Vados
-# RouterOS script: AM-CertsRenew
-# Script comment: Renew locally issued certificates
+# RouterOS script: AM-DOHCerts
+# Script comment: Renew locally Cloudflare DOH certificates
 # Copyright (c) 2005-2026 Vados <vados@vados.ru>
 #
 #
-# requires RouterOS, version=7.19
+# requires RouterOS, version=7.15
 #
 :local ExitOK false;
 :onerror Err {
@@ -13,46 +13,58 @@
       do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
   :local ScriptName [ :jobname ];
 
-  :global CertIssuedExportPass;
+#  :global CertIssuedExportPass;
 
   :global LogPrint;
-  :global MkDir;
-  :global ScriptLock;
+#  :global MkDir;
+#  :global ScriptLock;
 
 # Add this Script scheduler
-:if ([ :len [ /system/scheduler/find where name=$ScriptName ] ] = 0) do={
-:log warning ("System Scheduler for script: " . $ScriptName . " is NOT SET! Fix It Now!");
-:local OnEvent "/system/script/run $ScriptName;";
-:local Comment "Every Day Check For Update Local Issued Certificates.";
+#:if ([ :len [ /system/scheduler/find where name=$ScriptName ] ] = 0) do={
+#:log warning ("System Scheduler for script: " . $ScriptName . " is NOT SET! Fix It Now!");
+#:local OnEvent "/system/script/run $ScriptName;";
+#:local Comment "Every Day Check For Update Local Issued Certificates.";
 #/system/scheduler/add name=$ScriptName comment=$Comment start-time=startup interval=1d on-event=$OnEvent;
+#}
+
+###############################################
+# Scheduler - Auto-update every 14 days
+###############################################
+
+/system scheduler
+:if ([:len [find name="update-doh-ca"]] = 0) do={
+    add name="update-doh-ca" \
+        interval=2w \
+        on-event="/import 12a-dns-doh-ca.rsc" \
+        start-time=03:00:00 \
+        comment="Auto-update Cloudflare Root CA for DoH"
 }
 
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :set ExitOK true;
-    :error false;
-  }
-
-  :foreach Cert in=[ /certificate/find where issued expires-after<3w ] do={
-    :local CertVal [ /certificate/get $Cert ];
-    /certificate/issued-revoke $Cert;
-    /certificate/set name=($CertVal->"name" . "-revoked-" . [ /system/clock/get date ]) $Cert;
-    /certificate/add name=($CertVal->"name") common-name=($CertVal->"common-name") \
-        key-usage=($CertVal->"key-usage") subject-alt-name=($CertVal->"subject-alt-name");
-    /certificate/sign ($CertVal->"name") ca=($CertVal->"ca");
-    :if ([ :typeof ($CertIssuedExportPass->($CertVal->"common-name")) ] = "str") do={
-      :if ([ $MkDir "cert-issued" ] = true) do={
-        /certificate/export-certificate ($CertVal->"name") type=pkcs12 \
-            file-name=("cert-issued/" . $CertVal->"common-name") \
-            export-passphrase=($CertIssuedExportPass->($CertVal->"common-name"));
-        $LogPrint info $ScriptName ("Issued a new certificate for '" . $CertVal->"common-name" . \
-          "', exported to 'cert-issued/" . $CertVal->"common-name" . ".p12'.");
-      } else={
-        $LogPrint warning $ScriptName ("Failed creating directory, not exporting certificate.");
-      }
-    } else={
-      $LogPrint info $ScriptName ("Issued a new certificate for '" . $CertVal->"common-name" . "'.");
-    }
-  }
-} do={
-  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+:log info "Cloudflare CA auto-update scheduler configured"
+
+###############################################
+# Cloudflare Root CA Certificate Update
+###############################################
+
+:local CF_CA_URL "https://developers.cloudflare.com/ssl/static/origin_ca_ecc_root.pem"
+:local CF_CA_FILE "cloudflare-root.pem"
+
+# Remove old certificate file
+/file
+:if ([:len [find name=$CF_CA_FILE]] > 0) do={
+    remove $CF_CA_FILE
 }
+
+# Download CA certificate
+/tool fetch \
+    url=$CF_CA_URL \
+    dst-path=$CF_CA_FILE \
+    keep-result=yes
+
+:delay 2s
+
+# Import certificate
+/certificate
+import file-name=$CF_CA_FILE passphrase=""
+
+:log info "Cloudflare DoH Root CA updated from $CF_CA_URL"
diff --git a/html/AM-GlobalFunc.rsc b/html/AM-GlobalFunc.rsc
index 9084b7789..f68e21927 100644
--- a/html/AM-GlobalFunc.rsc
+++ b/html/AM-GlobalFunc.rsc
@@ -17,9 +17,9 @@
 :global GlobalFuncReady false;
 
 # Git commit id & info, expected configuration version
-:global CommitId "main/231/47b67063";
+:global CommitId "main/232/9e7c2095";
 :global CommitTAG "unknown";
-:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 21:55:02 15.04.2026.";
+:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 22:00:02 15.04.2026.";
 
 # The variables are received right here.
 :global GlobalConfVersion 138;