Forum Discussion
Ripkey_120880
Nimbostratus
Jan 30, 2014Bulk move SSL Certs
Hi,
I'm currently doing an LTM migration from 2 3400's running 10.2.2 to a new pair running 11.4.1. I was wondering if there is a way to bulk export all the certs and then import them into the new L...
Kevin_K_51432
Jan 30, 2014Historic F5 Account
Hi Jason, I'm not aware of any easy way to do this. If I had to perform a bulk upload myself, I'd use a combination of bash and tmsh.
- Create a /var/tmp/key directory and move all the keys there using SCP.
- Create a /var/tmp/crt directory and move all the certs there using SCP.
- Once all the certs and keys are in place you should be able to run these:
for i in `ls -1 /var/tmp/key`; do tmsh install sys crypto key $i from-local-file /var/tmp/key/$i; done
for i in `ls -1 /var/tmp/crt`; do tmsh install sys crypto cert $i from-local-file /var/tmp/crt/$i; done
tmsh save sys config
I tried this with three cert / key pairs:
tmsh list sys crypt key
sys crypto key siteone.key {
key-size 2048
key-type rsa-private
security-type normal
}
sys crypto key sitethree.key {
key-size 2048
key-type rsa-private
security-type normal
}
sys crypto key sitetwo.key {
key-size 2048
key-type rsa-private
security-type normal
}
tmsh list sys crypto cert
sys crypto cert siteone.crt {
certificate-key-size 2048
city Seattle
common-name localhost.localdomain
country US
email-address root@localhost.localdomain
expiration Dec 25 10:13:15 2023 GMT
organization MyCompany
ou IT
state WA
subject-alternative-name
}
sys crypto cert sitethree.crt {
certificate-key-size 2048
city Seattle
common-name localhost.localdomain
country US
email-address root@localhost.localdomain
expiration Dec 25 10:13:15 2023 GMT
organization MyCompany
ou IT
state WA
subject-alternative-name
}
sys crypto cert sitetwo.crt {
certificate-key-size 2048
city Seattle
common-name localhost.localdomain
country US
email-address root@localhost.localdomain
expiration Dec 25 10:13:15 2023 GMT
organization MyCompany
ou IT
state WA
subject-alternative-name
}
- Sec-Enabled_658Aug 16, 2014
Cirrostratus
Those commands worked great for importing on the box, but is there is a command to export the key/certs in bulk? In the GUI, you can export as an "archive" but it would be nice via CLI. I dont see a way to do through tmsh
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects