Forum Discussion

The-messenger's avatar
Icon for Cirrostratus rankCirrostratus
Nov 05, 2021

Import cert/key together to prevent mismatching

Looking at version 14.1.4, I have BigIPs in 2 data centers. In one data center I have an updated (renewed) SSL cert/key. If I export the cert and key file and then try to import in the other data center I will get "doesn't match" when trying to import. Is there any way to import the cert and key at the same time to prevent this?

4 Replies

    1. Is this a device cert or a site cert?
    2. Was the cert generated via the GUI or via the CLI using openssl commands?
    3. Is it a self-signed cert or is it from an SSL cert provider?
    4. Does the key have a password? If the CSR was done via the GUI, I believe the key isn't encrypted and thus no password required.


    This info should help with answering your question.






    • The-messenger's avatar
      Icon for Cirrostratus rankCirrostratus

      The cert is being exported from one device imported to another. There is no CSR here, just exporting and importing.

      I resolved it. I used openssll to combine the .key and .crt file to a .pfx file. Then used the .pfx file to import, at the other datacenter, over-writing the existing cert in place.

      • Fallout1984's avatar
        Icon for Cirrocumulus rankCirrocumulus

        Ah, okay. Good. I normally use openssl commands when creating certs, more control that way. There's one cert that I have to merge into PFX format for a particular backend server, but that's about the only time I have to use that format.


        Another thing I started doing as part of my cert creation routine was verify the hash of the CSR and the key match before I export it for the cert request:




        Generate hash for the private key:


        openssl pkey -in /config/ssl/ssl.key/ -pubout -outform pem | sha256sum


        Generate hash for the csr:


        openssl req -in /config/ssl/ssl.csr/ -pubkey -noout -outform pem | sha256sum

  • Thanks.

    This what I ended up doing, I started out with the assumption that I could export the key and cert together so it took awhile to switch to openssl.