Which steps enable remote WebFig access over HTTPS?

• A. Install a certificate but leave HTTPS disabled.
• B. /ip service enable https; ensure certificate and proper firewall rules.
• C. Disable HTTPS and use HTTP only.
• D. Enable WebFig over HTTP and leave ports open.

Answer: (B)

The key idea is that remote WebFig access over HTTPS only works when the HTTPS service is enabled, a valid certificate is in place for TLS, and the router is reachable through your firewall/NAT rules. On RouterOS you must turn on the https service under /ip service so the web interface can speak over TLS. A certificate is required because HTTPS relies on TLS to encrypt the session; without a certificate the connection won’t establish securely or browsers will warn you. Having a certificate ensures the host name you connect to is trusted and the handshake completes.

In addition, you need firewall rules that permit the incoming HTTPS traffic (typically port 443) to reach the device, and, if you’re accessing from the internet, appropriate NAT or input-chain allowances so remote clients can actually reach the router. With https enabled, a valid certificate, and proper firewall/NAT configuration, you can securely access WebFig remotely via HTTPS.

Why the other approaches don’t fit: installing a certificate alone won’t help if HTTPS is disabled, since there’s no secure channel to use. Using HTTP bypasses HTTPS entirely, which defeats the goal of secure remote access. Enabling WebFig over HTTP and leaving ports open exposes the interface without encryption, which is insecure and not the intended secure remote access.