Forum Discussion
iControl and Powershell - key import and certificate import
I am attempting to script out importing a SSL crt/key pair into a new F5 running 11.3. I'm using iControl within Powershell. I've successfully used iControl and Powershell for other tasks on this new F5. Below is my sample code which doesn't seem to be working. Any ideas/suggestions?
$SSLDir = Path to folder containing crt and key files on my machine $url = "www.myurl.com"
$crtfilename = $url + ".crt" $keyfilename = $url + ".key" $keyfile = $SSLDir + "\" + $keyfilename $crtfile = $SSLDir + "\" + $crtfilename
(Get-F5.iControl).ManagementPartition.Set_active_partition("Common") (Get-F5.iControl).ManagementKeyCertificate.key_import_from_file(0,$url,$keyfile,$false) (Get-F5.iControl).ManagementKeyCertificate.certificate_import_from_file(0,$url,$crtfile,$false)
Try this one?
if ( (Get-PSSnapin | Where-Object { $_.Name -eq "iControlSnapIn"}) -eq $null ){ Add-PSSnapIn iControlSnapIn } Setup Credentials $user = 'myuser' $pass = 'mypass' $SSLDir = "" $url = "mysite.com" $success = Initialize-F5.iControl -HostName 10.10.10.10 -Username $user -Password $pass; $f5 = Get-F5.iControl $crtfilename = $url + ".crt" $keyfilename = $url + ".key" $keyfile = $SSLDir + "\" + $keyfilename $crtfile = $SSLDir + "\" + $crtfilename $F5.ManagementPartition.Set_active_partition("Common") $F5.ManagementKeyCertificate.key_import_from_file( "MANAGEMENT_MODE_DEFAULT", (,$url), (,$keyfile), $false ) $F5.ManagementKeyCertificate.certificate_import_from_file( "MANAGEMENT_MODE_DEFAULT", (,$url), (,$certfile), $false )
/Patrik
- dmacika_116140
Nimbostratus
Still doesn't work.
- Yeah, I realized that too. Gives no error, but no certificate is shown in the gui or filestore. Also tried the PEM importer using text, but failed that one too.
Then I'm at a loss. I sent a message to the iControl guru. Hopefully he'll have time to enlighten us mortals.
/Patrik
- dmacika_116140
Nimbostratus
I revisted this myself and tried using import from pem instead of import from file, but that fails as well.
- Hank_Stallings
Nimbostratus
Were you ever able to get this working?
- dmacika_116140
Nimbostratus
Negative. I have it on my task list of things to tackle. Most likely I will have to open a support case at some time. In the meantime, our service desk has been importing new certs and keys manually via the web interface.
- Hank_Stallings
Nimbostratus
Bummer, automating this is on my list and it doesn't look promising. I understand that it works with Ruby, but I have no experience (or much desire) in that. If I ever come up with anything I'll update this. I'm surprised that F5 hasn't stepped in and assisted on this forum.
- dmacika_116140
Nimbostratus
I had this fully automated in v10.x (upload new crt key pair and create a SSL Client profile if one did not already exist), but whatever I had there doesn't work in 11.x
- Hank_Stallings
Nimbostratus
Could you share the code you used back when it worked? - dmacika_116140
Nimbostratus
I was using upload-f5.file previously. I understand this won't work in 11.x due to change to how SSL certs are stored in the F5. $rmcrt = "/config/ssl/ssl.crt/" + $pathurl + ".crt" $rmkey = "/config/ssl/ssl.key/" + $pathurl + ".key" upload-f5.file -RemoteFile $rmcrt -LocalFile $crtfile upload-f5.file -RemoteFile $rmkey -LocalFile $keyfile
- Tim_K_92675
Cirrostratus
Looks like the mode is being passed in as a string? Try something like this:
$mgmtModeType = New-Object -TypeName iControl.ManagementKeyCertificateManagementModeType $mgmtModeType.value__ = 0
Then add it into the call:
$F5.ManagementKeyCertificate.key_import_from_file( $mgmtModeType, (,$url), (,$keyfile), $false )
- Hank_Stallings
Nimbostratus
Didn't help, no error, but it doesn't import the crt/key - dmacika_116140
Nimbostratus
Yeah, that's the same result I've been seeing.
- Hank_Stallings
Nimbostratus
take a look at this posting
https://devcentral.f5.com/questions/what-is-the-path-to-a-users-home-directory-from-root
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com