Forum Discussion

nemas_341981's avatar
nemas_341981
Icon for Nimbostratus rankNimbostratus
Nov 28, 2017

SSL Certificate and key not matching

Hi All,

 

I have created CSR in F5 with RSA 2048 bits. After that I have encrypted & installed using below command: openssl rsa -des -in Common:unencypted_example.key -out Common:encrypted_example.key

 

tmsh install /sys crypto key encrypted_example.key from-local-file /config/filestore/files_d/Common_d/certificate_key_d/:Common:encrypted_example.key

 

Now I got the certificate from CA. When i tried to match certificate and encrypted key i am getting below error.

 

The certificate and private key do NOT match!

 

Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 Key Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

 

But when I tried to match with certificate and unencrypted key it is matched.

 

Is that normal ? or do I need to do something to apply in profile

 

BIG-IP
LTM
security
  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Nov 28, 2017

    Is that normal ? or do I need to do something to apply in profile

    No. In fact f5 will not allow to install key/cert. It will return error. Might be added extra character or space. There are many online tool to match key & cert or CSR and Cert hash value. Hope it will help.

        https://www.sslshopper.com/certificate-key-matcher.html
    • nemas_341981's avatar
      nemas_341981
      Icon for Nimbostratus rankNimbostratus
      Nov 28, 2017

      i have used same sites to match but it shows above error. when i match with csr and certificate it is matching, when i match with certificate and unencrypted key it is matching. only certificate and encrypted key not matching.

       

      How we resolve this issue. I need to apply encrypted key and certificate in profile

       

    • Samir_Jha_52506's avatar
      Samir_Jha_52506
      Icon for Noctilucent rankNoctilucent
      Nov 28, 2017

      Cert, Key & CSR is already in cipher text format right & its encrypted. Have you generated csr on f5 device or else?

       

      Another option is save key & cert file in ur machine & delete key and cert from F5 and re-import it.

       

      Lets see if it works for you.!! paste the comments.

       

    • nemas_341981's avatar
      nemas_341981
      Icon for Nimbostratus rankNimbostratus
      Nov 28, 2017

      I have generated CSR in F5 device and when i was generated the CSR i didn't use any challenge password. Do i need to encrypt certificate as well.

       

      Certificate and encrypted key match : The certificate and private key do NOT match!

       

      Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 Key Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

       

      Certificate and unencypted key match : The certificate and private key match!

       

      Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 Key Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1

       

      Certificate and CSR match : The certificate and CSR match!

       

      Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 CSR Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1