I noticed that the f5-ca-bundle.crt file contains an obsolete (root) certificate. At least up to (and including) TMOS 17.5.1.
This causes a failure when trying to update the ca-bundle.crt file using the Configuration Utility (System ›› Certificate Management : Traffic Certificate Management : Bundle Manager List) in /var/log/ltm:
notice keymgmtd[8795]: 01a40000:5: BundleMgr /Common/ca-bundle importing from all sources.<br>notice keymgmtd[8795]: 01a40000:5: Download failed: https://cdn.f5.com/product/ca-bundle/blended-bundle.crt - <strong><span class="lia-text-color-8">Peer certificate cannot be authenticated with given CA certificates</span></strong><br>notice keymgmtd[8795]: 01a40000:5: BundleMgr /Common/ca-bundle import aborted. No change to ca-bundle /Common/ca-bundle.crt
The server certificate of cdn.f5.com requires a new root CA in f5-ca-bundle.crt (noticeably: “Subject: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46”).
This was reported to F5 TAC, and will be fixed in a future release (as promised), but F5 TAC is unable to share a BugID with me.
Work around is to add (or replace?) the new certificate to f5-ca-bundle.crt, touch /service/mcpd/forceload, and reboot the appliance). This needs to be repeated after each upgrade as well, until F5 has fixed this issue.
# <strong>cp -ip /config/ssl/ssl.crt/f5-ca-bundle.crt /config/ssl/ssl.crt/f5-ca-bundle.crt.ORIG</strong><br><br># <strong>cat << EOF >> /config/ssl/ssl.crt/f5-ca-bundle.crt</strong><br>-----BEGIN CERTIFICATE-----<br>MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf<br>MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD<br>Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw<br>HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY<br>MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp<br>YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB<br>AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa<br>ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz<br>SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf<br>iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X<br>ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3<br>IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS<br>VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE<br>SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu<br>+Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt<br>8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L<br>HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt<br>zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P<br>AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c<br>mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ<br>YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52<br>gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA<br>Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB<br>JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX<br>DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui<br>TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5<br>dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65<br>LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp<br>0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY<br>QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL<br>-----END CERTIFICATE-----<br>EOF<br><br># <strong>touch /services/mcpd/forceload</strong><br><br># <strong>reboot</strong>