Forum Discussion

jsgibbs1's avatar
jsgibbs1
Icon for Nimbostratus rankNimbostratus
Oct 13, 2017

01070317:3: profile /Common/profile-name key and certificate do not match

I successfully imported a cert/key pair under System | File Management | SSL Certificate List. I uploaded the .key file first and then the certificate to have both combined into one file. However, when I tried to create the SSL Client profile, I got the error in the subject.

 

Running these two commands on each confirmed I had a mismatch: openssl x509 -noout -modulus -in certificate.crt | openssl md5 openssl rsa -noout -modulus -in privateKey.key | openssl md5

 

My question is why did the F5 not throw an error during the original import process of if they weren't a matching pair?

 

application delivery
LTM
  • Kevin_Davies's avatar
    Kevin_Davies
    Icon for Nacreous rankNacreous
    Oct 13, 2017

    When you imported it does it appear as Cert & Key on a single line in the SSL certificate list?

     

  • jsgibbs1's avatar
    jsgibbs1
    Icon for Nimbostratus rankNimbostratus
    Oct 13, 2017

    Yes, by importing .key first and then .crt, they are combined on one line.

     

  • Kevin_Davies's avatar
    Kevin_Davies
    Icon for Nacreous rankNacreous
    Oct 13, 2017

    If you try the following command with your cert and key what happens?

    openssl pkcs12 -export -out certificate.pfx -inkey ssl.key -in ssl.crt -certfile intermediate.crt

    The -certfile option is only needed if you have an intermediate certificate.

  • Simon_Blakely's avatar
    Simon_Blakely
    Icon for Employee rankEmployee
    Oct 15, 2017

    On v11.x and later, key and certificate are validated against each other when they are assigned to a ClientSSL profile. They are still separate entities in the file management screen, even when they are listed as a key/certificate pair after importing (due to being assigned the same name).

     

  • Kevin_Davies's avatar
    Kevin_Davies
    Icon for Nacreous rankNacreous
    Oct 16, 2017

    If you want to validate before importing to the GUI then your solution is to use the following command to create pkcs12 file. If the certs don't match then it will throw an error.

    openssl pkcs12 -export -out cert.pks -inkey ssl.key -in ssl.crt

    Then you can install the pkcs file from the GUI or command line with the following...

    tmsh install sys crypto pkcs12 certname from-local-file cert.pks

    This will install the cert and key together in the one action.