Forum Discussion
NimbostratusUploading/creating SSL cert+key using iControlREST
Hi,
The documentation available seem to say that to actually add an SSL private key and certificate to BigIP using tmsh you need to generate them somewhere and manually copy them to /config/ssl/ssl.key/, only after that it is possible to 'add' them on tmsh.
Is it also the case with iControl(REST) ? if so that's quite a limitation ...
8 Replies
kunjanYes, need to upload some temp directory, may be using scp. Then use RestAPi to create the cert/key pair and then SSL profile.
- benoit_9199
Well apparently you can create a crypto key using "create /sys crypto key gen-csr" so it should be possible to do this with the iControl api
I'll look further in this direction, i would preferer not to mix scp and RestAPI ...
- benoit_9199
Apparement quelques questions sans réponses existent sur le sujet:
https://devcentral.f5.com/questions/generate-a-csr-with-icontrol-rest https://devcentral.f5.com/questions/generate-csr-and-upload-new-cert-through-icontrolrest-api
- benoit_9199
Well, after asking F5 support it is a referenced bug ID489843: "A GET on some file object configurations (for example tm/sys/crypto/key) does not return all of the properties of the file object."
And the expected way to use it will be:
POST //mgmt/tm/sys/crypto/key HTTP/1.1 Host: 10.208.102.28 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/json Cache-Control: no-cache { "name":"test001", "options":[{"get-csr":"test001"}], "common-name":"rest.test.com" }
mayouche_162667Hi, I was able to create a key using rest api calls, but i'm unable to generate the CSR. Could you please clarify whether this is a known f5 bug?- benoit_9199Well, actually i opened a case last week for this exact problem. i'll keep you posted on the results
- benoit_9199Apparently the whole command is buggy, you should contact your support representative and make them aware you are facing this bug so it get the maximum attention possible: ID 511582 iControl REST - Get error msg when creating "sys crypto csr" object, but it does get created.
