使用RosZ升级服务器的RouterOS设备报错：ssl: name verification failed for: “CN=*.rosz.cn” 解决方法

使用RosZ升级服务器的RouterOS设备报错：ssl: name verification failed for: "CN=*.rosz.cn" ，原因是因为7.23.5新版本在系统升级system update中默认使用https进行升级包下载，原有的dns修改方式因为ssl证书不匹配导致报错。

如果希望继续使用RosZ升级服务器，请执行以下命令，把默认更新方式改为http：

/system package update set mode=http

2026-09-17更新：建议导入https证书，即可使用基于https和证书验证的更新模式

{
#rosz.cn self-hosted RouterOS upgrade server: enable https mode, for RouterOS 7.23 and later
:log info "RosZCert: step1 download root certificate"
/file remove [find name="RosZUpgrade.cer"]
:do {/tool fetch url="https://upgrade.rosz.cn/cert/RosZUpgrade.cer" dst-path="RosZUpgrade.cer"} on-error={:log error "RosZCert: step1 download failed"}
:local certSize 0
:if ([:len [/file find name="RosZUpgrade.cer"]]>0) do={:set certSize [/file get [/file find name="RosZUpgrade.cer"] size]}
:log info "RosZCert: step1 download done, size=$certSize"
:if ($certSize=1115) do={
:log info "RosZCert: step2 replace root certificate"
/certificate remove [find name~"RosZUpgrade"]
:delay 1s
/certificate import file-name="RosZUpgrade.cer" name=RosZUpgrade passphrase=""
:delay 2s
/file remove [find name="RosZUpgrade.cer"]
:if ([:len [/certificate find fingerprint="40fc213a0fa3ee08295562219e1075575ff4674f1ea912c80e5432f373cc8e90" trusted=yes]]>0) do={
:log info "RosZCert: step3 certificate trusted, switch to https mode"
/system package update set mode=https check-certificate=yes
:put "OK: certificate imported, upgrade mode switched to https with certificate check"
} else={
:log error "RosZCert: step3 fingerprint mismatch, rollback to http mode"
/certificate remove [find name~"RosZUpgrade"]
/system package update set mode=http check-certificate=no
:put "FAILED: fingerprint mismatch, certificate removed, upgrade mode set back to http"
}
} else={
:log error "RosZCert: step1 certificate size abnormal, size=$certSize"
/file remove [find name="RosZUpgrade.cer"]
:put "FAILED: download incomplete, nothing changed, please retry later"
}
}

如果想切换回官方升级通道，可执行以下命令：

{
#还原升级服务器为Mikrotik
/ip dns static remove [find name=upgrade.mikrotik.com]
/ip dns cache flush
}

注意官方通道在国内使用下载会比较慢。