Forum Discussion
Extract info from client ssl profile
when i list client-ssl profiles i noticed that some profiles have cert right after app-service, while other client profiles cert-key-chain. Any idea on why, i don't see anything.
(tmos)# list ltm profile client-ssl bantam.dcpds.cpms_cs
ltm profile client-ssl bantam.dcpds.cpms_cs {
app-service none
cert bantam.dcpds.cpms.osd.mil_10_10_2025
cert-key-chain {
bantam.dcpds.cpms.osd_ALL_CA_CERTS_BUNDLE-21AUGUST2024_0 {
cert bantam.dcpds.cpms.osd.mil_10_10_2025
chain ALL_CA_CERTS_BUNDLE-21AUGUST2024
key bantam.dcpds.cpms.osd.mil_10_10_2025
}
}
defaults-from clientssl
inherit-ca-certkeychain true
inherit-certkeychain false
key bantam.dcpds.cpms.osd.mil_10_10_2025
options { dont-insert-empty-fragments no-tlsv1.3 no-tlsv1.1 no-dtlsv1.2 no-sslv3 no-tlsv1 }
}
(tmos)# list ltm profile client-ssl bantamemp.dcpds.cpms_cs
ltm profile client-ssl bantamemp.dcpds.cpms_cs {
app-service none
cert-key-chain {
bantamemp.dcpds.cpms.osd_ALL_CA_CERTS_BUNDLE-07October2024_0 {
cert bantamemp.dcpds.cpms.osd.mil-2022
chain ALL_CA_CERTS_BUNDLE-07October2024
key bantamemp.dcpds.cpms.osd.mil-2022
}
}
defaults-from clientssl
inherit-ca-certkeychain true
inherit-certkeychain false
options { dont-insert-empty-fragments no-tlsv1.3 no-tlsv1.1 no-dtlsv1.2 no-sslv3 no-tlsv1 }
}
- May 25, 2025
I had used a similar ps1 script in the past
with liitle modifaction I see it works for what you want but verify yourself also# Variables $f5Host = "https://<BIGIP-IP>" # ← Change to your F5 management IP or hostname $username = "admin" $password = "password" # ← Change to your F5 admin password # Disable SSL verification (equivalent to curl -k) add-type @" using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy { public bool CheckValidationResult( ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) { return true; } } "@ [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy # Encode credentials $pair = "${username}:${password}" $encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($pair)) $headers = @{ Authorization = "Basic $encodedCreds" } # Get list of client-ssl profiles $response = Invoke-RestMethod -Uri "$f5Host/mgmt/tm/ltm/profile/client-ssl" -Headers $headers -Method Get # Loop through each profile and get cert-key info foreach ($profile in $response.items) { Write-Output "Profile: $($profile.name)" # Set name $name = $profile.name # Get full details of the profile $detail = Invoke-RestMethod -Uri "$f5Host/mgmt/tm/ltm/profile/client-ssl/$name" -Headers $headers -Method Get foreach ($ckc in $detail.certKeyChain) { Write-Output " Cert: $($ckc.cert)" Write-Output " Key: $($ckc.key)" Write-Output " Chain: $($ckc.chain)" } Write-Output "" }
*just for the record the original script have been provided by one of my colleagues in the past
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com