For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chris_18457's avatar
Chris_18457
Icon for Cirrus rankCirrus
Nov 10, 2014

CSR with ampersand

I am in the process of renewing our SSL certificate with fields that include "&". However the "&" shows as "&" -- had to show this as because the support page reads it in a the actual character :)

 

Example: AT&T. When I provided the CSR to Verisign for renewal, I get a field missmatch.

 

The original certificate was generated running code version probably 11.3 HF5 (maybe 10.2.4...hard to remember 12 months ago). Currently running 11.5.1 HF5. The original certificate and CSR have the "&" not the unicode? equivalent.

 

Also should note that I tried this as a new CSR creation on the LTM and a renewal. Both produced the same results. Didnt see anything on DevCentral or the other support pages. Anyone else ran into this or know how to get around it?

 

Chris

 

application delivery
LTM
management
security

7 Replies

  • Chris_18457's avatar
    Chris_18457
    Icon for Cirrus rankCirrus
    Nov 10, 2014
    Interesting.... Page rendering removed my notation when I posted. Should be &(semicolon). Example: AT&(semicolon)T
  • R_Marc's avatar
    R_Marc
    Icon for Nimbostratus rankNimbostratus
    Nov 10, 2014

    I'm guessing you used the Web Interface to create it? I believe your browser is encoding on post.

    You could use TMSH to do it (I think it's easier that way anyway):

     create sys crypto key YourKey  common-name  "YourCert" ou "Test" organization "Cogs & Cogs" city "Your City" state "YourState"  gen-csr
  • Chris_18457's avatar
    Chris_18457
    Icon for Cirrus rankCirrus
    Nov 10, 2014

    Correct, I was using the GUI (firefox at the time). I tried IE8 (company install)...same results. I'll try via tmsh and see if the results are the same.

     

    • R_Marc's avatar
      R_Marc
      Icon for Nimbostratus rankNimbostratus
      Nov 10, 2014
      I tested before I sent: 
      $ openssl req -in test.pem -text
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=US, ST=YourState, L=Your City, O=Cogs & Cogs, OU=Test, CN=YourCert
  • Jim_Couch_16225's avatar
    Jim_Couch_16225
    Icon for Nimbostratus rankNimbostratus
    Feb 10, 2015
    I have the same issue. I am using 11.5.1 and I ended up using tmsh but for me, it is not faster (lack of experience). I recently upgraded my lab BIG-IP to 11.6.0, hoping that if fixed the issue but it doesnt seem to.
  • ShawnR's avatar
    ShawnR
    Icon for Nimbostratus rankNimbostratus
    Jun 08, 2015

    We are also seeing this issue after upgrading from 11.2.1 to 11.6.0.

     

    If it was the browser causing it, then would it not have occurred in the previous version as well?