For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

wonned_165453's avatar
wonned_165453
Icon for Nimbostratus rankNimbostratus
Jul 31, 2014

sol11438: Creating SSL SAN certificates and CSRs using OpenSSL

I have a certificate problem where F5 does not include the SAN extension in the generated CSR. See the following doc for details sol13770: The BIG-IP system fails to include the Subject Alternative Name extension while generating a CSR.

 

The workaround is to use OpenSSL to generate the CSR, see (sol11438). The problem is that I receive the following error for key mismatch when I try to import the certificate signed by CA. Is there away to tell F5 where to look for the private key under /var/tmp/mySSL/www.example.com.key?

 

01070313:3: Error reading key PEM file /config/filestore/files_d/Common_d/certificate_key_d/:Common:example.com.key_15190_1 for profile /Common/example.com: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
LTM
management
security
TMSH

2 Replies

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    Jul 31, 2014

    You should just need to import the key first. In the web ui, under certificates, do an import, Import type is key, give it a name and then paste/upload the key. You will then see the key in the certificate list. Click it and choose import under the certificate tab, and again paste/upload the certificate.