Forum Discussion
NimbostratusCA Certificate Authorities DST ACES CA X6 - DigiNotar expired
Dears all,
The Certificate Authorities Bundle in the BIG-IP box has a few root/intermediary certificates expired or expiring soon. Some of them are "DigiNotar", "DST ACES CA".
I know that upgrading the box this part will be upgraded as well but I cannot do it because I am migrating everything to a new and more powerful BIG-IP which will take some months. Also the version is higher. OLD BIG-IP is running 11.6.1, new BIG-IP is runnig 12.1.2.
I had a look at this problem around internet and I have found some useful information but I have to still understand how much important is to react on this issue.
On the test-virtual BIG-IP running V11.6.1-Last HF, I have tried to use the iApp template "; as described in "K18929326" but I see that nothing changes. The CA Bundle stays the same and the same certificates are expired.
I have also viewd this K15847 and it says that this problem applyes only to 11.4 version but instead I see that the same certificates (DigiNotar) are expired on the version 11.6.1.
Do you have any suggestion on what I have to do?
Thank you in advance. Luigi
Greetings Luigi,
It may be easier to simply download the most recent CA bundle and associate that with the client SSL profile. If you navigate to downloads, look for "Certificate-Authority-Bundle":https://downloads.f5.com/esd/productlines.jsp
Alternatively, you can try the workaround in the article you mentioned: K15847.
Hope this is helpful!
Kevin
luigi_brosHi Kevin,
I have done everything in a test Virtual-F5 environment but I can see that there is no way to delete the original ca-bundle and neither is possible to be ovewritten by the new one. Having a look at configuration "scf" exported I can see that they are referenced by some natively Application Templates.
As a result I have no other choices than leaving the original "ca-bundle" in the big-ip and getting from time to time email alerts saying the a certificate in the original "ca-bundle" is going to expire.
Am I wrong?
Had I better give up and ignore this or there is a way to put everything in order?
Thank you. luigi_bros
Hi Luigi,
The ca-bundle.crt shouldn't take up much disk space, can you leave it on the BIG-IP and reference the newly imported one? Just give it a different name when you import it:
ca-bundle-2017.crt
If you've configured email alerts, you can stop them with the following:
https://support.f5.com/csp/article/K36641730
Hope this is helpful!
Kevin
