iControl and Powershell - key import and certificate import

Worked with F5 support and came up with a working solution. Import_from_pem was failing for me at first. Key is to use the -raw flag on the get-content. Hope this helps others in the future.

 $url is the common name of the certificate.
 .crt and .key files are stored as $url.crt and $url.key
$url = "www.mydomain.com"

 IP address of the F5
$srv = "1.2.3.4"

 Directory where the crt and key files are placed
$SSLDir = "D:\temp" 

Add-PSSnapIn iControlSnapIn -ErrorAction SilentlyContinue
Initialize-F5.iControl -Hostname $srv -Credentials (Get-Credential)

(Get-F5.iControl).ManagementPartition.Set_active_partition("Common")

$crtfilename = $url + ".crt" 
$keyfilename = $url + ".key" 
$keyfile = $SSLDir + "\" + $keyfilename 
$crtfile = $SSLDir + "\" + $crtfilename

$key_pem = get-content $keyfile -raw
$crt_pem = get-content $crtfile -raw

if ( (test-path $keyfile) -and (test-path $crtfile) ) {
      (Get-F5.iControl).ManagementKeyCertificate.Key_import_from_pem("MANAGEMENT_MODE_DEFAULT",$url,$key_pem,1)
      (Get-F5.iControl).ManagementKeyCertificate.certificate_import_from_pem("MANAGEMENT_MODE_DEFAULT",$url,$crt_pem,1)
} else {
      write-host "Missing Files"
}

take a look at this posting

https://devcentral.f5.com/questions/what-is-the-path-to-a-users-home-directory-from-root

Looks like the mode is being passed in as a string? Try something like this:

$mgmtModeType = New-Object -TypeName iControl.ManagementKeyCertificateManagementModeType
$mgmtModeType.value__ = 0

Then add it into the call:

 $F5.ManagementKeyCertificate.key_import_from_file(
                $mgmtModeType,
                (,$url),
                (,$keyfile),
                $false
                )

I had this fully automated in v10.x (upload new crt key pair and create a SSL Client profile if one did not already exist), but whatever I had there doesn't work in 11.x

Bummer, automating this is on my list and it doesn't look promising. I understand that it works with Ruby, but I have no experience (or much desire) in that. If I ever come up with anything I'll update this. I'm surprised that F5 hasn't stepped in and assisted on this forum.

Negative. I have it on my task list of things to tackle. Most likely I will have to open a support case at some time. In the meantime, our service desk has been importing new certs and keys manually via the web interface.

Were you ever able to get this working?

I revisted this myself and tried using import from pem instead of import from file, but that fails as well.

Then I'm at a loss. I sent a message to the iControl guru. Hopefully he'll have time to enlighten us mortals.

/Patrik

Still doesn't work.