/certificate add name=ca-template common-name=MyCA key-size=2048 days-valid=3650 key-usage=crl-sign,key-cert-sign; /certificate sign ca-template ca-crl-host=127.0.0.1 name=MyCA; /certificate add name=api-ssl common-name=10.254.254.102 key-size=2048 days-valid=3650 key-usage=digital-signature,key-encipherment,tls-server; /certificate sign api-ssl ca=MyCA name=api-ssl; /ip service set api-ssl certificate=api-ssl disabled=no port=8729