Bulk move SSL Certs

Hi Jason, I'm not aware of any easy way to do this. If I had to perform a bulk upload myself, I'd use a combination of bash and tmsh.

1. Create a /var/tmp/key directory and move all the keys there using SCP.
2. Create a /var/tmp/crt directory and move all the certs there using SCP.
3. Once all the certs and keys are in place you should be able to run these:

    for i in `ls -1 /var/tmp/key`; do tmsh install sys crypto key $i from-local-file /var/tmp/key/$i; done
    for i in `ls -1 /var/tmp/crt`; do tmsh install sys crypto cert $i from-local-file /var/tmp/crt/$i; done
    tmsh save sys config

I tried this with three cert / key pairs:

 tmsh list sys crypt key
sys crypto key siteone.key {
    key-size 2048
    key-type rsa-private
    security-type normal
}
sys crypto key sitethree.key {
    key-size 2048
    key-type rsa-private
    security-type normal
}
sys crypto key sitetwo.key {
    key-size 2048
    key-type rsa-private
    security-type normal
}

 tmsh list sys crypto cert
sys crypto cert siteone.crt {
    certificate-key-size 2048
    city Seattle
    common-name localhost.localdomain
    country US
    email-address root@localhost.localdomain
    expiration Dec 25 10:13:15 2023 GMT
    organization MyCompany
    ou IT
    state WA
    subject-alternative-name
}
sys crypto cert sitethree.crt {
    certificate-key-size 2048
    city Seattle
    common-name localhost.localdomain
    country US
    email-address root@localhost.localdomain
    expiration Dec 25 10:13:15 2023 GMT
    organization MyCompany
    ou IT
    state WA
    subject-alternative-name
}
sys crypto cert sitetwo.crt {
    certificate-key-size 2048
    city Seattle
    common-name localhost.localdomain
    country US
    email-address root@localhost.localdomain
    expiration Dec 25 10:13:15 2023 GMT
    organization MyCompany
    ou IT
    state WA
    subject-alternative-name
}

is there is a command to export the key/certs in bulk? In the GUI, you can export as an "archive" but it would be nice via CLI.

i am not aware of. anyway, cert and key files are in /config/filestore/files_d/Common_d/. also, by default they are included in ucs and scf file.

hope this helps.

On my v11.2 box, I saved the config using SCF, i.e. tmsh save sys config file and it created two files for me on /var/local/scf. One contains the configuration files and the other the certficates. I guess you can SCP the contents of the tar file into /var/tmp of the new BIGIP system and run the script above by Kevin K to properly install the SSL cert and keys. It would be nice if F5 can actually do these as part of Enterprise Manager or just as an option under System on a regular appliance.

On my v11.2 box, I saved the config using SCF, i.e. tmsh save sys config file and it created two files for me on /var/local/scf. One contains the configuration files and the other the certficates. I guess you can SCP the contents of the tar file into /var/tmp of the new BIGIP system and run the script above by Kevin K to properly install the SSL cert and keys. It would be nice if F5 can actually do these as part of Enterprise Manager or just as an option under System on a regular appliance.

This following is performed in the GUI.

1. Navigate to Local Traffic, SSL Certificates.
2. Click archive button.
3. Move everything from the right to the left. Both keys and certs
4. Now move default.key and default.crt back to the right hand side.
5. Specify a name for the file.
6. Click Generate and Download file.
7. On the new F5 click import.
8. Specify its an Archive file.
9. Select file.
10. Submit
11. Done