Forum Discussion

stecino_87658's avatar
stecino_87658
Icon for Nimbostratus rankNimbostratus
Jan 22, 2016

Private key format changes when migrating from 9.x to 11.x using IControl API

Hello,

 

I am running into an issue when I migrate private key from one LTM to another. This doesn't happen with crt file

 

I use obj.Management.KeyCertificate.key_export_to_pem to get the key

 

It's something like this:

 

['-----BEGIN RSA PRIVATE KEY-----\r<-------content-removed--------->\r\n-----END RSA PRIVATE KEY-----']

 

Then I take this key and import it into new LTM using:

 

dest_obj.Management.KeyCertificate.key_import_from_pem_v2

 

key is created but it looks like:

 

-----BEGIN PRIVATE KEY----- <--------removed the content> -----END PRIVATE KEY-----

 

Not only the header and footer look different with RSA dropped, but also the key content

 

What am I doing wrong?

 

Thanks in advance

 

devops
iControl

2 Replies

Sort By
  • stecino_87658's avatar
    stecino_87658
    Icon for Nimbostratus rankNimbostratus
    Jan 22, 2016
    Key Type in the old LTM is KTYPE_RSA_PRIVATE, and the Key Type in New LTM is RSA key_import_from_pem_v2 doesn't allow passing of the key_type explicitly, so I am not sure how to do it
  • Jason_Cohen_417's avatar
    Jason_Cohen_417
    Historic F5 Account
    Sep 23, 2016

    The format that starts with '-----BEGIN RSA PUBLIC KEY-----' is PKCS1. It is simply the key object. It must be an RSA key (as indicated by the block header). The format that starts with '-----BEGIN PUBLIC KEY-----' is PKCS8. The key type and algorithm are are encoded within the base64 encoded data.

     

    Further reading: http://stackoverflow.com/questions/20065304/what-is-the-differences-between-begin-rsa-private-key-and-begin-private-key

     

    Convert to PKCS8 format: $ openssl pkcs8 -topk8 -in keyfrom9x.key -nocrypt -out pcsk8.key $ md5sum pkcs8.key 2771112811d82b6fb29d55656d957b1e pkcs8.key << The key is the same as stored by the BIGIP $ md5sum 2771112811d82b6fb29d55656d957b1e keyimportedto11x.key

     

    $ openssl rsa -in pcsk8.key -out rsa-new.key << This should work, and does on my systems. writing RSA key

     

    $ md5sum rsa-new.key efb57dd9a66be6822669a673db007ea7 rsa-new.key << The key converted from PKCS1 to PKCS8 and back to PKCS1 $ md5sum efb57dd9a66be6822669a673db007ea7 keyfrom9x.key << is the same as the original