For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JRahm's avatar
JRahm
Icon for Admin rankAdmin
Nov 21, 2023

Hi Shereif, from AS3, you can reference them in the declaration as BIG-IP objects like this:

 

"certs_on_bigip": {
    "class": "Certificate",
    "certificate": {
        "bigip":"/Common/my.test.local.crt"
    },
    "privateKey": {
        "bigip":"/Common/my.test.local.key"
    }
}

 

As far as uploading them with iControl REST directly, you need to upload the files, then use the

  • /mgmt/tm/sys/file/ssl-key
  • /mgmt/tm/sys/file/ssl-cert

endpoints to "import" them as BIG-IP objects. Note that you'll need to do any updates to cert/key pairs in use as BIG-IP objects on ssl profiles in a transaction. (there are definitely benefits to managing this in AS3 instead)

Anyway, here's an example of how that's done in python in my Let's Encrypt cert automation repo on Github:

https://github.com/f5devcentral/lets-encrypt-python/blob/main/hook_script.py#L74-L108

 

  • Shereif's avatar
    Shereif
    Icon for Altostratus rankAltostratus
    Nov 21, 2023

    Thank you  for getting back.

    I probably should have elaborated a little bit more on my scenario

    I have my own python wrapper for the BIGIP API ( not using the SDK ), assuming that there is a platform that I can API to generate certificates and keys ( not F5 ), now in my program I have the actual cert and key text in memory and I don't want to write them on disc and then upload them. 

    given the two API endpoints you mentioned

    /mgmt/tm/sys/file/ssl-key
    /mgmt/tm/sys/file/ssl-cert

    what would the API call look like, there are a few keys that should be sent in the POST body here APIRef_tm_sys_file_ssl-key (f5.com) but I can't figure out thow to just send the cert and key text, without refering to a file on disc

    hypothetical call using /mgmt/tm/sys/file/ssl-key and using a partition that is not Common

    POST request with JSON body as following

    {
    "name": "mykey.key",
    "tmPartition": "Partition1",
    "whatkey?": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA6E4h6p1AaatxTQ0BZqEu987eMMz+embO+VBtrlnVddsdXdc-----END RSA PRIVATE KEY-----\n"
}

    after making that hypothetical call, the key should now be recognized on the F5 as mykey.key and I can reference it in the AS3 as you mentioned earlier.

    I hope that cleared the scenario.

    note: if there's a postman request example for the above scenario that would be great

    Regards,

    Shereif

    • JRahm's avatar
      JRahm
      Icon for Admin rankAdmin
      Nov 21, 2023

      Hi Shereif I don't think that won't work in the icontrol rest interface, but I'll do a little digging.

      you can do this directly with an AS3 declaration though.

      • JRahm's avatar
        JRahm
        Icon for Admin rankAdmin
        Nov 21, 2023

        you can reference a sourcePath object from cert/key creation, but that has to exist in a file or from ftp/http target. If your python wrapper wanted to serve up that cert/key as a web route in flask/fastapi/pyramid, etc...that might work for you, otherwise you'll need to use AS3 declaration to send as strings.