Mixing
How to create ssl-client profile on f5 ltm with Icontrol REST API
My goal: to upload my ssl cert, create a ssl-client profile for my virtual server to use…
So with a lot of digging through old posts and guessing at icontrol rest documentation meaning : I was able to my .pfx file from my locally installed computer - to a .crt and .key uploaded to the f5 ltm (BIG-IP 13.1.1 Build 0.0.4 Final)
they show up in the gui like this: (sorry i can't upload an image)
Side note / question: in the past my manual process for setting up ssl-client profiles is using the gui to install the pfx directly - this makes the ssl certificate have both the certificate and key associated with each other:
$params = @{"name"="$nameofprofile";"key"="/Common/$nameofkey";"cert"="/Common/$nameofcert.crt";}
$json = $params | convertto-json
$headers = @{Authorization = $basicAuthValue}
$url = "https://$bigip/mgmt/tm/ltm/profile/client-ssl"
Invoke-WebRequest $url -Method POST -Headers $Headers -Body $json -ContentType "application/json"
This is returning the following error:
Invoke-WebRequest : {"code":400,"message":"010717e3:3: Client SSL profile (/Common/donsTest-ssl-2019): must have RSA certificate/key pair.","errorStack":,"apiError":3}
Again I am not looking for powershell help (if you can that is great) but if you can help me understand the icontrol rest needed for this process:
I had found this page: https://devcentral.f5.com/wiki/iControlREST.APIRef_tm_ltm_profile_client-ssl.ashx
That says the way above is deprecated:
DEPRECATED - use cert-key-chain option instead.
But I have found no one using this /cert-key-chain array
Perhaps that is the secret?
powershell f5 big-ip invoke-webrequest icontrol
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
add a comment |
My goal: to upload my ssl cert, create a ssl-client profile for my virtual server to use…
So with a lot of digging through old posts and guessing at icontrol rest documentation meaning : I was able to my .pfx file from my locally installed computer - to a .crt and .key uploaded to the f5 ltm (BIG-IP 13.1.1 Build 0.0.4 Final)
they show up in the gui like this: (sorry i can't upload an image)
Side note / question: in the past my manual process for setting up ssl-client profiles is using the gui to install the pfx directly - this makes the ssl certificate have both the certificate and key associated with each other:
$params = @{"name"="$nameofprofile";"key"="/Common/$nameofkey";"cert"="/Common/$nameofcert.crt";}
$json = $params | convertto-json
$headers = @{Authorization = $basicAuthValue}
$url = "https://$bigip/mgmt/tm/ltm/profile/client-ssl"
Invoke-WebRequest $url -Method POST -Headers $Headers -Body $json -ContentType "application/json"
This is returning the following error:
Invoke-WebRequest : {"code":400,"message":"010717e3:3: Client SSL profile (/Common/donsTest-ssl-2019): must have RSA certificate/key pair.","errorStack":,"apiError":3}
Again I am not looking for powershell help (if you can that is great) but if you can help me understand the icontrol rest needed for this process:
I had found this page: https://devcentral.f5.com/wiki/iControlREST.APIRef_tm_ltm_profile_client-ssl.ashx
That says the way above is deprecated:
DEPRECATED - use cert-key-chain option instead.
But I have found no one using this /cert-key-chain array
Perhaps that is the secret?
powershell f5 big-ip invoke-webrequest icontrol
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03
add a comment |
My goal: to upload my ssl cert, create a ssl-client profile for my virtual server to use…
So with a lot of digging through old posts and guessing at icontrol rest documentation meaning : I was able to my .pfx file from my locally installed computer - to a .crt and .key uploaded to the f5 ltm (BIG-IP 13.1.1 Build 0.0.4 Final)
they show up in the gui like this: (sorry i can't upload an image)
Side note / question: in the past my manual process for setting up ssl-client profiles is using the gui to install the pfx directly - this makes the ssl certificate have both the certificate and key associated with each other:
$params = @{"name"="$nameofprofile";"key"="/Common/$nameofkey";"cert"="/Common/$nameofcert.crt";}
$json = $params | convertto-json
$headers = @{Authorization = $basicAuthValue}
$url = "https://$bigip/mgmt/tm/ltm/profile/client-ssl"
Invoke-WebRequest $url -Method POST -Headers $Headers -Body $json -ContentType "application/json"
This is returning the following error:
Invoke-WebRequest : {"code":400,"message":"010717e3:3: Client SSL profile (/Common/donsTest-ssl-2019): must have RSA certificate/key pair.","errorStack":,"apiError":3}
Again I am not looking for powershell help (if you can that is great) but if you can help me understand the icontrol rest needed for this process:
I had found this page: https://devcentral.f5.com/wiki/iControlREST.APIRef_tm_ltm_profile_client-ssl.ashx
That says the way above is deprecated:
DEPRECATED - use cert-key-chain option instead.
But I have found no one using this /cert-key-chain array
Perhaps that is the secret?
powershell f5 big-ip invoke-webrequest icontrol
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
My goal: to upload my ssl cert, create a ssl-client profile for my virtual server to use…
So with a lot of digging through old posts and guessing at icontrol rest documentation meaning : I was able to my .pfx file from my locally installed computer - to a .crt and .key uploaded to the f5 ltm (BIG-IP 13.1.1 Build 0.0.4 Final)
they show up in the gui like this: (sorry i can't upload an image)
Side note / question: in the past my manual process for setting up ssl-client profiles is using the gui to install the pfx directly - this makes the ssl certificate have both the certificate and key associated with each other:
$params = @{"name"="$nameofprofile";"key"="/Common/$nameofkey";"cert"="/Common/$nameofcert.crt";}
$json = $params | convertto-json
$headers = @{Authorization = $basicAuthValue}
$url = "https://$bigip/mgmt/tm/ltm/profile/client-ssl"
Invoke-WebRequest $url -Method POST -Headers $Headers -Body $json -ContentType "application/json"
This is returning the following error:
Invoke-WebRequest : {"code":400,"message":"010717e3:3: Client SSL profile (/Common/donsTest-ssl-2019): must have RSA certificate/key pair.","errorStack":,"apiError":3}
Again I am not looking for powershell help (if you can that is great) but if you can help me understand the icontrol rest needed for this process:
I had found this page: https://devcentral.f5.com/wiki/iControlREST.APIRef_tm_ltm_profile_client-ssl.ashx
That says the way above is deprecated:
DEPRECATED - use cert-key-chain option instead.
But I have found no one using this /cert-key-chain array
Perhaps that is the secret?
powershell f5 big-ip invoke-webrequest icontrol
powershell f5 big-ip invoke-webrequest icontrol
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
asked Jan 2 at 19:11
Don FoutsDon Fouts
609
609
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03
add a comment |
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54011906%2fhow-to-create-ssl-client-profile-on-f5-ltm-with-icontrol-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54011906%2fhow-to-create-ssl-client-profile-on-f5-ltm-with-icontrol-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
This may or may not help you, but I found this pdf K58820342: Error Message: 010717e3:3: Client SSL profile must have RSA certificate/key pair for you.
– Theo
Jan 2 at 20:03