Procedure to generate CSR through LTM

It depends a bit what you want the certificate to be used for (ltm, device certificate, certificate to be used for inter device communication i.e. via iQuery). Especially if your certs are NOT to be used for LTM the signing certificate authority must adopt the requested attributes in the CSR.

In case of using subject alternative names it might be necessary to switch to command line to create a new CSR (consumer parameter specifies the purpose of the new certificate):

tmsh create sys crypto key gen-csr "" consumer ltm key-size 2048 \
city "" state "" country "" \
organization "" ou "your_org_unit" \
subject-alternative-name "DNS:,DNS:" \
common-name ""

A CSR will be created. The related private key will be found in the TMOS filestore. Please do NOT append an extension like .key, .crt or .csr to the "".

Only the common-name is mandatory.