Now go to Mikrotik > PPP > Interface Tab > SSTP Server (Button) > Certificate: Select your SSL (X509) Mikrotik – SSTP Server Setup Left column “ KLT (private Key, revocation List, Trusted).System > Certificates > Import > SSL.PFX (PKCS12) > Password: YourPassword.Left column, only “LT” (revocation List, Trusted).System > Certificates > Import > SSL.CER (Base64) > Password:.Get both of these files to your workstation running Winbox.įiles > Drag in both files to the Files window Expand Certificates (Local Computer) > Personal > Certificates > Right-Click Your SSL > All Tasks > Export > “No, do not export the Private Key” > BASE64 Encoded Binary X.509 > Export to: … > File Type: *.CER.Expand Certificates (Local Computer) > Personal > Certificates > Right-Click Your SSL > All Tasks > Export > “Yes, export the Private Key” > Export to: … > File Type: *.PFX > Protect with YourPassword.File > Add Snap In > Computer Account > Local > OK.If you cannot export the private key, it means you are on a server that did not create the key – check other servers within that company, like Exchange or RDS. We need to export the installed SSL on the server into two types: A PKCS#12 “.PFX” (Contains Private Key) and an BASE64-encoded X509 “.CER” (Public Cert Only).Įasiest to perform these steps on the server that created the SSL (so it has the private key and matching certificate). Installing a Signed Certificate Request.Here are a two detailed SSL creation/install guides from GoDaddy if need help with this step: The only part not included in this guide is creating a publicly signed SSL request, and getting it signed. Once it’s setup and working, SSTP beats L2TP every time hands down! The SSL you use, needs to have the private key included, takes extra work to extract.Wildcards work great, along with standard SSLs. You must have a SSL certificate that includes your public DNS address ().

Due to being TCP based, and less sensitive to latency, you can get much higher throughput for bad connections.Mac clients require a bit more work, but it functions the same. Setup for Windows clients is built in, reliable, and simple.Since it runs over TCP443, the same port as HTTPS, almost every network allows it’s traffic through if there is outbound filtering. More reliable in bad conditions (weak WiFi signal, cell-hotspot), less likely to drop than L2TP/IPSec, because SSTP is TCP based, and less sensitive to latency.No timeouts, you can stay connected for an indefinite amount of time.

Important if you have multiple employees that travel to the same site, like a hotel or other business.

Multiple clients can connect from the same Public IP.

SSTP is now my go-to for business clients, and here is a step-by-step guide to help you set one up on a Mikrotik Router :-). I’ve played with L2TP/IPSec, IKEv2, PPTP, and SSTP VPN Servers.

Mac sstp vpn client