For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nemas_341981's avatar
nemas_341981
Icon for Nimbostratus rankNimbostratus
Nov 28, 2017

SSL Certificate and key not matching

Hi All,   I have created CSR in F5 with RSA 2048 bits. After that I have encrypted & installed using below command: openssl rsa -des -in Common:unencypted_example.key -out Common:encrypted_exampl...
BIG-IP
LTM
security
Samir_Jha_52506's avatar
Samir_Jha_52506
Icon for Noctilucent rankNoctilucent
Nov 28, 2017

Is that normal ? or do I need to do something to apply in profile

No. In fact f5 will not allow to install key/cert. It will return error. Might be added extra character or space. There are many online tool to match key & cert or CSR and Cert hash value. Hope it will help.

    https://www.sslshopper.com/certificate-key-matcher.html
  • nemas_341981's avatar
    nemas_341981
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2017

    i have used same sites to match but it shows above error. when i match with csr and certificate it is matching, when i match with certificate and unencrypted key it is matching. only certificate and encrypted key not matching.

     

    How we resolve this issue. I need to apply encrypted key and certificate in profile

     

  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Nov 28, 2017

    Cert, Key & CSR is already in cipher text format right & its encrypted. Have you generated csr on f5 device or else?

     

    Another option is save key & cert file in ur machine & delete key and cert from F5 and re-import it.

     

    Lets see if it works for you.!! paste the comments.

     

  • nemas_341981's avatar
    nemas_341981
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2017

    I have generated CSR in F5 device and when i was generated the CSR i didn't use any challenge password. Do i need to encrypt certificate as well.

     

    Certificate and encrypted key match : The certificate and private key do NOT match!

     

    Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 Key Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

     

    Certificate and unencypted key match : The certificate and private key match!

     

    Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 Key Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1

     

    Certificate and CSR match : The certificate and CSR match!

     

    Certificate Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1 CSR Hash: 1ab36133f2fe7e5e192733f37e1474ee08a8459b4bb4a93ca8af7a6c3c5c7de1

     

  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Nov 28, 2017

    Password is not allowed. It should work. Have you re-imported key & cert?

    Try to import 

    Certificate and unencypted key match : The certificate and private key match!