1. generate the certificates
/certificate add name=root-crt common-name=router.krai.local days-valid=3650 key-usage=key-cert-sign,crl-sign /certificate sign root-crt /certificate add name=www-crt common-name=router.krai.local days-valid=3650 /certificate sign ca=root-crt www-crt /ip service set www-ssl certificate=www-crt disabled=no
2. start the ssl-web service
/ip service enable www-ssl
done