Forum Discussion

mikey_webb's avatar
mikey_webb
Icon for Cirrus rankCirrus
Jan 28, 2016

LTM and GTM device certificates

I'm running 11.4.1 and looking to go to 11.6 and currently I have device certificate of 1024.   I know 11.6 is standard 2048 and believe although not recommends 1024 will still work, but with that...
BIG-IP
devops
LTM
Domai's avatar
Domai
Icon for Altostratus rankAltostratus
Jan 28, 2016

When you add ltm's to gtm by using "bigip_add" and "gtm_add" commands it uses 22, 443 to exchange the certs and only then iQuery would start working on port 4353. The certs are copied on to GTM under "trusted certs". I think you need to update LTM's first and restore the device trust between them. Once you validate the ltm's are back to normal, you would see the iQuery calls from the GTM failing. Quickly copy the certs on to gtm is what I think would be the way to go. Yes there would be impact with the above method. Your GTM's will stop responding to the requests because they will not be able to query the status of the ltm's and their vip's.