Forum Discussion

JRahm's avatar
JRahm
Icon for Admin rankAdmin

Hi Shereif, from AS3, you can reference them in the declaration as BIG-IP objects like this:

 

"certs_on_bigip": {
    "class": "Certificate",
    "certificate": {
        "bigip":"/Common/my.test.local.crt"
    },
    "privateKey": {
        "bigip":"/Common/my.test.local.key"
    }
}

 

As far as uploading them with iControl REST directly, you need to upload the files, then use the

  • /mgmt/tm/sys/file/ssl-key
  • /mgmt/tm/sys/file/ssl-cert

endpoints to "import" them as BIG-IP objects. Note that you'll need to do any updates to cert/key pairs in use as BIG-IP objects on ssl profiles in a transaction. (there are definitely benefits to managing this in AS3 instead)

Anyway, here's an example of how that's done in python in my Let's Encrypt cert automation repo on Github:

https://github.com/f5devcentral/lets-encrypt-python/blob/main/hook_script.py#L74-L108

 

Shereif's avatar
Shereif
Icon for Altostratus rankAltostratus
Nov 21, 2023

Thank you  for getting back.

I probably should have elaborated a little bit more on my scenario

I have my own python wrapper for the BIGIP API ( not using the SDK ), assuming that there is a platform that I can API to generate certificates and keys ( not F5 ), now in my program I have the actual cert and key text in memory and I don't want to write them on disc and then upload them. 

given the two API endpoints you mentioned

/mgmt/tm/sys/file/ssl-key
/mgmt/tm/sys/file/ssl-cert

what would the API call look like, there are a few keys that should be sent in the POST body here APIRef_tm_sys_file_ssl-key (f5.com) but I can't figure out thow to just send the cert and key text, without refering to a file on disc

hypothetical call using /mgmt/tm/sys/file/ssl-key and using a partition that is not Common

POST request with JSON body as following

{
    "name": "mykey.key",
    "tmPartition": "Partition1",
    "whatkey?": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA6E4h6p1AaatxTQ0BZqEu987eMMz+embO+VBtrlnVddsdXdc-----END RSA PRIVATE KEY-----\n"
}

after making that hypothetical call, the key should now be recognized on the F5 as mykey.key and I can reference it in the AS3 as you mentioned earlier.

I hope that cleared the scenario.

note: if there's a postman request example for the above scenario that would be great

Regards,

Shereif

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 21, 2023

    Hi Shereif I don't think that won't work in the icontrol rest interface, but I'll do a little digging.

    you can do this directly with an AS3 declaration though.

    • JRahm's avatar
      JRahm
      Icon for Admin rankAdmin
      Nov 21, 2023

      you can reference a sourcePath object from cert/key creation, but that has to exist in a file or from ftp/http target. If your python wrapper wanted to serve up that cert/key as a web route in flask/fastapi/pyramid, etc...that might work for you, otherwise you'll need to use AS3 declaration to send as strings.

      • Shereif's avatar
        Shereif
        Icon for Altostratus rankAltostratus
        Nov 23, 2023

        JRahm Thank you for getting back.

        I wish there was a way where we can use the iControl REST to upload the cert and key payloads directly, that would make life much easier.

        nonetheless, Thank you for looking into this

        Regards,

        Shereif