Forum Discussion

Michael_Million's avatar
Michael_Million
Icon for Nimbostratus rankNimbostratus
May 29, 2006

IIS Certs into LTM

Hi,

 

 

I have several IIS SSL Certificates.

 

 

I want to configure my LTM to terminate my SSL sessions and have the web servers run on port 80. To do this, I need to install my current certificates on the LTM.

 

 

I have successfully installed the certificates, but I'm having a heck of a time obtaining the private keys from my current certificates to paste them into the LTM to allow me to create the appropiate IIS profiles for my Virtual Servers.

 

 

I'm sure someone else has crossed this bridge before, but I could not find their post.

 

 

Help...

 

 

Thanks ahead of time for your help,

 

Michael
application delivery
dev
devops
iRules
  • Chad_Emerson_85's avatar
    Chad_Emerson_85
    Icon for Nimbostratus rankNimbostratus
    May 30, 2006
    Importing an IIS .pfx file certificate into Apache or other non-Windows-based servers.

     

     

    Most servers use plaintext certificate files. The certificate files that you download from your digicert account are already in this format. However, the private key that was generated on your IIS server is not yet in this format. This same private key is required for your certificate to function properly on your non-Windows-based server. To export the private key from the Windows IIS server to your non-windows-based machine, you must extract the private key from a Windows .pfx backup certificate. To do this you will use the OpenSSL utility to extract the private key from the .pfx backup file:

     

    1.) First backup the certificate you have working on your IIS server to a .pfx file using the instructions listed above.

     

    2.) Second, use the following OpenSSL command to create a new text file from which you can separate the Private Key:

     

     

    openssl pkcs12 -in mypfxfile.pfx -out outputfile.txt -nodes

     

     

    where mypfxfile.pfx is the certificate backup from your IIS server.

     

     

    3.) The above command would have created a text file named outputfile.txt. Open this file with a text editor and you will see the private key listed first:

     

     

    -----BEGIN RSA PRIVATE KEY-----

     

    (Block of Random Text)

     

    -----END RSA PRIVATE KEY-----

     

     

     

    4.) Copy and paste all of the private key, including the BEGIN and END tags to a new text file and save it as your_domain_name.key

     

    5.) Use the Digicert Certificate Installation Instructions to install the the .key file you just created and the other certificate files from your Digicert Account to your new server.

     

     

     

    Another great question that would fall into a dedicated LTM forum! Hope this helps!

     

  • Michael_Million's avatar
    Michael_Million
    Icon for Nimbostratus rankNimbostratus
    May 31, 2006
    This worked perfectly. The only thing that I ran into is that some of our certificates were imported with the ability to export button not selected. Therefore, when creating the .pfx, the private key is not part of it. I'm still researching how to get around this.

     

     

    Thanks for the quick and acturate response,

     

    Michael