Solved

Can we confirm the certificate and its key can work well by some command?

Posted on 2016-09-18
2
57 Views
Last Modified: 2016-09-21
Hi After we import certificate and its key and then upgrade, do we have some commands to confirm they can work well in F5?   Thank you
0
Comment
Question by:eemoon
2 Comments
 
LVL 6

Accepted Solution

by:
DPatel earned 500 total points
ID: 41804197
Impact of procedure: Performing the following procedure should not have a negative impact on your system.

Use Secure Copy protocol (SCP) to transfer the new SSL certificate and key files to the BIG-IP system.
Note: For more information about transferring files into the BIG-IP system, refer to SOL175: Transferring files to or from an F5 system.

o Install the certificate to the /config/ssl/ssl.crt/ directory

o Install the key to the /config/ssl/ssl.key/ directory

Log in to the Traffic Management Shell (tmsh) by typing the following command:
tmsh

To install the SSL certificate, use the following command syntax:
Note: To install the certificate and key files into a specific partition, run the cd /<partition> command.

install /sys crypto cert <SSL-certificate-name> from-local-file <path-to-certificate-file>

For example:

install /sys crypto cert sol14031cert from-local-file /config/ssl/ssl.crt/sol14031.crt

To install the SSL key, use the following command syntax:
install /sys crypto key <SSL-key-name> from-local-file <path-to-key-file>

For example:

install /sys crypto key sol14031key from-local-file /config/ssl/ssl.key/sol14031.key

To verify that the SSL certificate has been successfully installed into the BIG-IP system, use the following command syntax:
list /sys crypto cert <SSL-certificate-name>

For example:

list /sys crypto cert sol14031cert

Note: If you install the SSL certificate properly, you can view the output of a list of SSL certificate attributes.

To verify that the SSL key has been successfully installed into the BIG-IP system, use the following command syntax:
list /sys crypto key <SSL-key-name>

For example:
list /sys crypto key sol14031key

Note: If you install the SSL key properly, you can view the output of a list of SSL key attributes.

To save the changes, type the following command:
save /sys config

To exit the tmsh utility, type the following command:
quit

Creating a new SSL profile using the newly imported SSL certificate and key

Impact of procedure: Performing the following procedure should not have a negative impact on your system.

Log in to the tmsh utility by typing the following command:
tmsh

To create a new SSL profile, use the following command syntax:
create /ltm profile <SSL-Profile-Type> <SSL-Profile-Name> cert <SSL-Certificate-Name> key <SSL-Key-Name>

For example, to create a Client SSL profile with the name sol14031_profile, using the certificate and key imported as sol14031cert and sol14031key, you can type the following command:
create /ltm profile client-ssl sol14031_profile cert sol14031cert key sol14031key

After you create the required SSL profiles, save the change by typing the following command:
save /sys config

To exit the tmsh utility, type the following command:
quit
0
 

Author Comment

by:eemoon
ID: 41809857
Thank you so much for your reply. It is very good!!
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
There are many Password Managers (PM) out there to choose from. PM's can help with your password habits and routines, but they should not be a crutch you rely on too heavily. I also have an article for company/enterprise PM's.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question