Forum Discussion

Shereif's avatar
Shereif
Icon for Altostratus rankAltostratus
Nov 20, 2023

Upload LTM SSL Certificate and Key using REST API

I'm trying to upload and existing certificate and key using the API but I can't find a working way so far.

The Idea is to upload the cert and key, then later reference them in an AS3 declaration. I am aware that I can directly reference the cert and key content in AS3 but due to how the process works, I want to upload the files first then later reference them in an AS3 declaration.

Thank yo in advance

Regards,

Shereif

 

application delivery
AS3 iControl REST API SSL Certificates upload
devops
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 21, 2023

    Hi Shereif, from AS3, you can reference them in the declaration as BIG-IP objects like this:

     

    "certs_on_bigip": {
    "class": "Certificate",
    "certificate": {
        "bigip":"/Common/my.test.local.crt"
    },
    "privateKey": {
        "bigip":"/Common/my.test.local.key"
    }
}

     

    As far as uploading them with iControl REST directly, you need to upload the files, then use the

    • /mgmt/tm/sys/file/ssl-key
    • /mgmt/tm/sys/file/ssl-cert

    endpoints to "import" them as BIG-IP objects. Note that you'll need to do any updates to cert/key pairs in use as BIG-IP objects on ssl profiles in a transaction. (there are definitely benefits to managing this in AS3 instead)

    Anyway, here's an example of how that's done in python in my Let's Encrypt cert automation repo on Github:

    https://github.com/f5devcentral/lets-encrypt-python/blob/main/hook_script.py#L74-L108

     

    • Shereif's avatar
      Shereif
      Icon for Altostratus rankAltostratus
      Nov 21, 2023

      Thank you  for getting back.

      I probably should have elaborated a little bit more on my scenario

      I have my own python wrapper for the BIGIP API ( not using the SDK ), assuming that there is a platform that I can API to generate certificates and keys ( not F5 ), now in my program I have the actual cert and key text in memory and I don't want to write them on disc and then upload them. 

      given the two API endpoints you mentioned

      /mgmt/tm/sys/file/ssl-key
      /mgmt/tm/sys/file/ssl-cert

      what would the API call look like, there are a few keys that should be sent in the POST body here APIRef_tm_sys_file_ssl-key (f5.com) but I can't figure out thow to just send the cert and key text, without refering to a file on disc

      hypothetical call using /mgmt/tm/sys/file/ssl-key and using a partition that is not Common

      POST request with JSON body as following

      {
    "name": "mykey.key",
    "tmPartition": "Partition1",
    "whatkey?": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA6E4h6p1AaatxTQ0BZqEu987eMMz+embO+VBtrlnVddsdXdc-----END RSA PRIVATE KEY-----\n"
}

      after making that hypothetical call, the key should now be recognized on the F5 as mykey.key and I can reference it in the AS3 as you mentioned earlier.

      I hope that cleared the scenario.

      note: if there's a postman request example for the above scenario that would be great

      Regards,

      Shereif

      • JRahm's avatar
        JRahm
        Icon for Admin rankAdmin
        Nov 21, 2023

        Hi Shereif I don't think that won't work in the icontrol rest interface, but I'll do a little digging.

        you can do this directly with an AS3 declaration though.