Forum Discussion

Mchelle_181998's avatar
Mchelle_181998
Icon for Cirrus rankCirrus
Nov 30, 2018

Error when installing CA to bundle

I have a signer CA, that I would like to add to F5. So that when we use self sign cert on F5 you will not get the message of this is not a trusted sight. This signer CA has been added to all of our corporate web browsers. So I have created a selfsign cert, I've added imported our CA to the ssl certificate list then created a ssl profile and added the cert and CA. When you go to the site I still get this is not a trusted sight. So I next tried using iApps I get the message of

 

script did not successfully complete: (Invalid Certificate Present: 'ssss'; Received the following error while validating Certificate: unable to load certificate 47544644358632:error:0906D066:PEM routines:PEM_read_bio:bad end line:pem_lib.c:804: while executing "error "Invalid Certificate Present: '${name}'; Received the following error while validating Certificate: ${err}"" ("foreach" body line 23) invoked from within "foreach row [join "$::ca__certificates"] { set certificate [split $row "\n"] set new_cert [string rang..." invoked from within "if { $::ca__restore == $::DEFAULT_ANSWER }{ Grab each certificate from certificates table and place into single variable ..." line:19) So I moved to to adding the CA to the server. I'm trying to verify chain certificate and I get this error bash: syntax error near unexpected token `newline' I'm following the article https://support.f5.com/csp/article/K6401

 

What is the correct way in getting the F5 to use our CA signer?

 

BIG-IP
security
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Nov 30, 2018

    Can you please clarify?

     

    A self-signed certificate is a certificate that signs itself, therefore has no reliance on an issuing CA. They're not related.

     

  • Mchelle_181998's avatar
    Mchelle_181998
    Icon for Cirrus rankCirrus
    Dec 07, 2018

    This self signed cert has to be signed by our Signer. I have tried adding our CA to the trusted CA on F5 but have not suceeded

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Dec 07, 2018

    This is just semantics, but a self-signed cert is not issued. It signs itself.

    In any case,

    • Is the CA certificate in PEM or DER format? If you can open it with a text editor and it contains the string "----- BEGIN CERTIFICATE -----", then it's PEM.
    • Is there anything else in the CA certificate besides what's between BEGIN and END CERTIFICATE? Sometimes there's additional comments in the text file.

    • If you can access a system with OpenSSL installed (like the BIG-IP) you can issue the following command:

      openssl x509 -text -in [cert.crt]

      If you get back readable certificate information, and no errors, then the certificate is in good shape.