Forum Discussion

newbief5_162606's avatar
Jun 10, 2016
Solved

Import SSL Cert

How to import SSL cert bundles and keychains to another LTM?

 

18 Replies

    • newbief5_162606's avatar
      newbief5_162606
      Icon for Cirrus rankCirrus
      I am trying to import my SSL certs from one LTM to another LTM. I am able to import the single certs, however trying to figure out how to import the bundle certs.
    • Hannes_Rapp_162's avatar
      Hannes_Rapp_162
      Icon for Nacreous rankNacreous
      Exactly the same way, there's no difference in the procedure if you use the copy/paste method. If you export as files, you will need to paste each of the individual certificates (one after another) to a notepad file, and then import that merged result. Notice that in a single certificate you have one BEGIN and one END tag; in a bundle cert, you have more.
    • newbief5_162606's avatar
      newbief5_162606
      Icon for Cirrus rankCirrus
      I am trying to import my SSL certs from one LTM to another LTM. I am able to import the single certs, however trying to figure out how to import the bundle certs.
    • Hannes_Rapp's avatar
      Hannes_Rapp
      Icon for Nimbostratus rankNimbostratus
      Exactly the same way, there's no difference in the procedure if you use the copy/paste method. If you export as files, you will need to paste each of the individual certificates (one after another) to a notepad file, and then import that merged result. Notice that in a single certificate you have one BEGIN and one END tag; in a bundle cert, you have more.
  • Hi Newbief5,

     

    It very easy to import though GUI.

     

    System-->File Management--> SSL --> Import--> Select "cert" & fill details.

     

  • Hi,

    There is a risk way to import all SSL to a new LTM.

    1. Take a UCS file of your old LTM.
    2. Take the master key of your old

      bash
      f5mku –K
      (Copy that)

    3. reKey your new LTM with the old LTM’s key

      f5mku –r <paste the masterkey of your old LTM>

    4. Import the UCS file from your old LTM to your new LTM

    5. Restore the UCS file on your new LTM:

      tmsh load sys ucs <name of ucs>.ucs no-license no-platform-check reset-trust

    6. Deleting all other configuration elements that you don’t want

    7. All SSL profiles will be there.

    Do not do this if the new LTM is already productive. This procedure is applicable just if you need all SSL on another LTM no matter what.

    • Samir_Jha_52506's avatar
      Samir_Jha_52506
      Icon for Noctilucent rankNoctilucent
      ucs doesn't contain SSL Key & cert file. If you need to move all key/cert to other LTM system then use archive method.
    • Misa_222415's avatar
      Misa_222415
      Icon for Cirrus rankCirrus
      Hi Samir Jha, I've done this several times, and yes it is possible.