Forum Discussion
Niklas_Ahl_6703
Dec 27, 2010Nimbostratus
Device certificate from intermediate CA
Hi!
I would like to add a trusted device certificate to our LTM and use it for the management interface.
We have our own CA that we issue certificates from, which is an intermediate CA, signed by our root CA.
The cert chain is: Root CA -> Intermediate signing CA -> Certificate
I've issued new certificate from our intermediate CA (with a new private key) and uploaded that under System/Device certificates.
However, I can't find how to attach the trusted certificate chain to the certificate in the GUI.
When working with ssl certificates through client ssl profiles, I can associate a CA chain to a profile.
Is there a similiar functionality for device certificates?
If there's no such thing in the GUI, is it possible to configure this with a commandline script?
/Niklas
- hooleylistCirrostratusCan you combine the certs in one file and specify that in the GUI for the device cert?
- hooleylistCirrostratusThat GUI image looks right. Can you restart httpd (bigstart restart httpd) and retest?
- Niklas_Ahl_6703Nimbostratushttpd restarted.
- JRahmAdminYes, when working with bigpipe you change the "running" configuration but not the "startup config. So you'll want to do a bigpipe save (or maybe bigpipe config save?) after verifying your changes.
- hooleylistCirrostratusHi Niklas,
- Niklas_Ahl_6703NimbostratusTried it on our passive node and it worked!
Hi,
here is a way to get it done in TMOS v11+. Copy the chain file (single intermediate CA file or bundle in PEM format) as
to theintermediate_ca.crt
directory and set permissions, i.e.:/config/httpd/conf/ssl.crt/
chmod 0644 /config/httpd/conf/ssl.crt/intermediate_ca.crt
Now declare it to be used as chain file to be delivered along with the device certificate during the initial handshake and restart the WebUI:
tmsh modify / sys httpd ssl-certchainfile /etc/httpd/conf/ssl.crt/intermediate_ca.crt bigstart restart httpd
Thanks, Stephan
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects