Generate private key w/ CSR via iControl REST

How can I specify a partition? When added to JSON it seems to be ignored

    Tested Version 16.1.3

#!/bin/bash

### Set Variables ###
fqdn="www.testing1.com"
bigip="mybigip.company.com"
partition="myPartition"
username="myUsername"
password="myPassword"
subjectAlternativeName="DNS:www.testing2.com,DNS:www.testing3.com""

### Set Data ###
data='{
"name":"'"$fqdn"'.key",
"commonName":"'"$fqdn"'",
"partition":"'"$partition"'",
"keySize":"4096",
"keyType":"rsa-private",
"options":[{"gen-csr":"'"$fqdn"'"}],
"organization":"ACME Inc ",
"ou":"IT Security",
"city":"Houston",
"state":"Texas",
"country":"US",
"subject-alternative-name":"DNS:'"$fqdn"','"$subjectAlternativeName"'"
}'

### Create Key & CSR ###
curl -sku $username:$password -X POST -H "Content-Type: application/json" -d "$data" https://$bigip/mgmt/tm/sys/crypto/key

### Download CSR ###
function list_csr() {
    data="{\"command\":\"run\",\"utilCmdArgs\":\"-c 'tmsh list sys crypto csr /"$partition"/"$fqdn".key \| grep -ve \'sys crypto\' -ve \'}\' -ve \' \' '\"}"
    curl -sku $username:$password -H "Content-Type: application/json" -X POST https://$bigip/mgmt/tm/util/bash -d "$data" | jq -r '.commandResult' | awk '/-----BEGIN CERTIFICATE REQUEST-----/,/-----END CERTIFICATE REQUEST-----/'
}

### Write CSR to a file ###
list_csr > "$fqdn".csr

### new line ###
echo -e "\n"

### Verify CSR ###
openssl req -text -noout -verify -in "$fqdn".csr

### Open CSR in default program ###
explorer "$fqdn".csr

Hi Gregory,

Thanks for the post! is there a GET or any other API to pull the newly created/generated CSR?

Regards,

Tushar,

Take a look at this: https://devcentral.f5.com/s/question/0D51T00006i7del/export-a-fips-based-csr-certificate-signing-request-via-icontrol

Let me know if that doesn't help.

The same can be done with python SDK:

mgmt.tm.sys.crypto.keys.key.create(name='www.testing.com.key', options=[{"gen-csr":"www.testing.com"}], commonName='www.testing.com', country='BE', city='Brussels', organization='AEL Lab', ou='IT', subjectAlternativeName='DNS:www.testing.com, DNS:testing.com')

But couldn't find a way to retrieve the CSR file or text directly with SDK? I guess we have to go via mgmt.tm.util.bash.exec_cmd

This helped me a lot!

Gregory do you know from here how I could retrieve the CSR and key text directly using the iControl RestAPI?

Check out this post: https://devcentral.f5.com/s/question/0D51T00006i7d2P/is-there-a-way-to-download-export-the-actual-key-rsa-certificate-files-from-bigip-using-the-icontrol-rest

Unfortunately I don't think there is a way to do it via iControl REST.

 add the following key pair in the above payload, it works for me

"partition":"PART1",

note: replace PART1 with your partition you want to generate the key on.

  Can you please share the code which worked for you?

 Here is the pay payload and URI for the CSR generations

https://{{bigip}}/mgmt/tm/sys/crypto/csr

Please note, you need to have key generated before prior to create the CSR.

{  
	"name": "www.example.com",  
	"commonName": "www.example.com",
    "partition":"TENANT_2",  
	"key": "www.example.com.key",  
	"organization": "Cutomer4",  
	"ou": "Engineering",  
	"city": "London",  
	"state_or_province_name": "England",
    "country": "UK",
	"email-address": "customer4@example2.com"
}