Forum Discussion
RJ_171490
Nimbostratus
NimbostratusHow to import a SSL Cert and Key to F5.
I'm browsing the SSL certificate list which I got from Comodo, and there are different types of Contents with the below mentioned extentions. I have experience in uploading certificates to F5 which is in .pfx format that contains both certificate and key in a single file but the newly received CA certificates giving me a hard time understanding which one is a cert file and which one is key file. Can someone help.
xyz_com.cer
xyz_com.crt
xyz_com.p7b
xyz_cert.cer
xyz_com_interm.cer
RJ_171490Edit: I have got the SSL certificate list from our Server team not Comodo.
- Kevin_Stewart
Employee
.cer, crt, and .p7b files are almost always (public) certificates. A private key would normally have a .key or .pem extension, but of course can be stored in pkcs12 .p12 or .pfx file. It doesn't look like any of the certificates you've listed are private keys, but you may still need to open them all in a text editor to know for sure.
If the file contains a string that looks like this
-----BEGIN RSA PRIVATE KEY-----then that will be a private key.
If you are renewing a certificate then it will simply re-use the already existing key. The only thing that gets renewed is the public certificate. Have you tried following this guide?
Importing a renewed SSL certificate
https://support.f5.com/csp/article/K1462014
When you import a renewed SSL certificate, you overwrite the existing certificate/key with the one you are importing. The SSL profile then automatically uses the renewed certificate to encrypt the SSL sessions.
Important: Existing connections continue to use the old SSL certificate until the connection completes or are renegotiated or until TMM is restarted.
Impact of procedure: Performing the following procedure should not have any impact to the existing traffic and new traffic will utilize the new certificate.
- Log in to the Configuration utility.
- Navigate to System > Certificate Management > Traffic Certificate Management > SSL Certificate List
Note: For BIG-IP 12.x and earlier, navigate to System > File Management > SSL Certificate List.
- Click Import.
- In the Import Type list, click Certificate.
- For Certificate Name, click Overwrite Existing.
- In the Certificate Name list, click the certificate to replace.
- For Certificate Source, click either Upload File and browse to the file or Paste Text and paste plain text into the box.
- Click Import.
To be honest I always generate a completely new PFX or CSR in order to renew both the certificate and key for security reasons. It will also give me the possibility to revert back to the old certificate in case there are some issues with the newly generated certificate/key. The only thing I have to do after uploading the new certificate/key pair is make the switch in the Client SSL Profile.
- Rebecca_Moloney
Admin
Here's some SSL related content from Technical Articles that might pique your interest:
F5 BIG-IP SSL Orchestrator Configuration with Advanced WAFaaS
Implementing SSL Orchestrator with OPSWAT MetaDefender
Integrating SSL Orchestrator with McAfee Web Gateway-Explicit Proxy
SSL Orchestrator Advanced Use Cases: Enabling GCloud Organization Restrictions
Integrating SSL Orchestrator with Cisco WSA Virtual Edition
Verified Design: SSL Orchestrator with McAfee Web Gateway-Part 1
SSL Orchestrator Advanced Use Cases: Fun with SaaS Tenant Isolation
