For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Herman2024's avatar
Herman2024
Icon for Cirrostratus rankCirrostratus
Jan 27, 2025
Solved

some questions on device Trust Certificate?

hi, I have two questions on device trust certificates (client cert).  why there are duplicate certificates on Device Trust Certificate list? I saw duplicate gtm device certificates in LTM devices. ...
announcement
application delivery
bigip
event
GTM DNS
LTM
security
  • Sebastiansierra's avatar
    Sebastiansierra
    Jan 28, 2025

    Hi Herman2024,

    If the certificate is the same, you can delete it, but before saving a UCS, duplication could happen in the bigip_add process if it were executed a couple of times, or maybe someone in your company uploaded the certificate after the bigip_add, but it is a little weird. I recommend you generate new self-signed certificates with the name of the hosts for the LTM and GTM devices to avoid generic certificates with the same name.

Sebastiansierra's avatar
Sebastiansierra
Icon for MVP rankMVP
Jan 27, 2025

Herman2024,

about your questions:

  1. review the serial number of the certificates. You are probably looking at the certificates from your GTM devices, but the certificate name has never been changed.
  2. The GTM-DNS stores the LTM-GTM certificates in other locations, you have to go to: DNS > GSLB > Servers > Trusted Server Certificates

I hope this answers your questions.

 

Herman2024's avatar
Herman2024
Icon for Cirrostratus rankCirrostratus
Jan 28, 2025

Hi Sebastiansierra ,thanks a lot for your kind advice. Regarding the question on the duplicate certificates, I have checked the serial numbers of cert, and really there is duplicate cert in Device Trust Certificate list on LTM -- same serial number, and other parameters. Can you please advise the possible cause of duplicate certificates? Thanks in advance!

  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Jan 28, 2025

    Hi Herman2024,

    If the certificate is the same, you can delete it, but before saving a UCS, duplication could happen in the bigip_add process if it were executed a couple of times, or maybe someone in your company uploaded the certificate after the bigip_add, but it is a little weird. I recommend you generate new self-signed certificates with the name of the hosts for the LTM and GTM devices to avoid generic certificates with the same name.

    • Herman2024's avatar
      Herman2024
      Icon for Cirrostratus rankCirrostratus
      Jan 30, 2025

      Hi Sebastiansierra , thanks a lot for your kind advice. I saw there were two GTM device certificates in LTM Device Trust List, one is old certificate which is already expired. Is this old expired certificate causing ssl certificate verification failure? Thanks again!

      • Sebastiansierra's avatar
        Sebastiansierra
        Icon for MVP rankMVP
        Jan 30, 2025

        Hi Herman2024,

        If the certificate is expired, you have to remove it! where did you find this issue? "causing ssl certificate verification failure"