Forum Discussion
Extract info from client ssl profile
when i list client-ssl profiles i noticed that some profiles have cert right after app-service, while other client profiles cert-key-chain. Any idea on why, i don't see anything.
(tmos)# list ltm profile client-ssl bantam.dcpds.cpms_cs
ltm profile client-ssl bantam.dcpds.cpms_cs {
app-service none
cert bantam.dcpds.cpms.osd.mil_10_10_2025
cert-key-chain {
bantam.dcpds.cpms.osd_ALL_CA_CERTS_BUNDLE-21AUGUST2024_0 {
cert bantam.dcpds.cpms.osd.mil_10_10_2025
chain ALL_CA_CERTS_BUNDLE-21AUGUST2024
key bantam.dcpds.cpms.osd.mil_10_10_2025
}
}
defaults-from clientssl
inherit-ca-certkeychain true
inherit-certkeychain false
key bantam.dcpds.cpms.osd.mil_10_10_2025
options { dont-insert-empty-fragments no-tlsv1.3 no-tlsv1.1 no-dtlsv1.2 no-sslv3 no-tlsv1 }
}
(tmos)# list ltm profile client-ssl bantamemp.dcpds.cpms_cs
ltm profile client-ssl bantamemp.dcpds.cpms_cs {
app-service none
cert-key-chain {
bantamemp.dcpds.cpms.osd_ALL_CA_CERTS_BUNDLE-07October2024_0 {
cert bantamemp.dcpds.cpms.osd.mil-2022
chain ALL_CA_CERTS_BUNDLE-07October2024
key bantamemp.dcpds.cpms.osd.mil-2022
}
}
defaults-from clientssl
inherit-ca-certkeychain true
inherit-certkeychain false
options { dont-insert-empty-fragments no-tlsv1.3 no-tlsv1.1 no-dtlsv1.2 no-sslv3 no-tlsv1 }
}
- Injeyan_KostasMay 25, 2025
Nacreous
I had used a similar ps1 script in the past
with liitle modifaction I see it works for what you want but verify yourself also# Variables $f5Host = "https://<BIGIP-IP>" # ← Change to your F5 management IP or hostname $username = "admin" $password = "password" # ← Change to your F5 admin password # Disable SSL verification (equivalent to curl -k) add-type @" using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy { public bool CheckValidationResult( ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) { return true; } } "@ [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy # Encode credentials $pair = "${username}:${password}" $encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($pair)) $headers = @{ Authorization = "Basic $encodedCreds" } # Get list of client-ssl profiles $response = Invoke-RestMethod -Uri "$f5Host/mgmt/tm/ltm/profile/client-ssl" -Headers $headers -Method Get # Loop through each profile and get cert-key info foreach ($profile in $response.items) { Write-Output "Profile: $($profile.name)" # Set name $name = $profile.name # Get full details of the profile $detail = Invoke-RestMethod -Uri "$f5Host/mgmt/tm/ltm/profile/client-ssl/$name" -Headers $headers -Method Get foreach ($ckc in $detail.certKeyChain) { Write-Output " Cert: $($ckc.cert)" Write-Output " Key: $($ckc.key)" Write-Output " Chain: $($ckc.chain)" } Write-Output "" }
*just for the record the original script have been provided by one of my colleagues in the past
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com