ClientSSL Profile. Key and Cert mismatch. Applying to Virtual Server

Your plan is correct - you only need a clientssl profile. The certificate and key must "match" but they won't match - They aren't identical files, so md5sum won't help you, but the CSR must be generated based on the key that was created. If you created the CSR on the F5, it will automatically create the associated key. Once you obtain the certificate from your certificate authority using the CSR that was generated, you then upload the certificate, matching it to the key you created (System | File Management | SSL Certificate List | click on the key you created, import the certificate).