Nimbostratus
NimbostratusmpelekhUnfortunately no solution for explicitly uploading the cert/key as they changed the behavior from v13 to v14+ via https://cdn.f5.com/product/bugtracker/ID535122.html.
That being said, we kept with our previous existing logic of simply uploading the .pfx instead of the cert/key seperately.
# Export the the x509CeritificateColllection with the passphrase; we will use this to upload it to the F5 appliance
$x509Certificate2CollectionByteArray = $x509Certificate2Collection.Export('Pkcs12', $securePassword)
$contentRange = "0-{0}/{1}" -f ($x509Certificate2CollectionByteArray.Length - 1), $x509Certificate2CollectionByteArray.Length
$f5CertHeaders = @{ 'Authorization' = "Basic $f5Base64Auth"
'Content-Length' = $x509Certificate2CollectionByteArray.Length
'Content-Range' = $contentRange
}
# Upload the certificate as a PFX to the appliance, this drops it in /var/config/rest/downloads/
Write-Verbose "Uploading '$F5CertificateName.pfx'"
$uploadResponse = Invoke-RestMethod -Uri "https://$F5Appliance/mgmt/shared/file-transfer/uploads/$F5CertificateName.pfx" -Method POST -Body $x509Certificate2CollectionByteArray -Headers $f5CertHeaders -ContentType "application/octet-stream" -ErrorAction Stop
$certBody = [ordered]@{"command" = "install"
"from-local-file" = $uploadResponse.localFilePath
"passphrase" = $securePassword
} | ConvertTo-Json
# Install the certificate by loading it from the file we just uploaded
Write-Verbose "Importing certificate '$F5CertificateName.pfx'"
$importResponse = Invoke-RestMethod -Uri "https://$F5Appliance/mgmt/tm/sys/crypto/pkcs12/$F5CertificateName" -Method POST -Body $certBody -Headers $f5AuthHeader -ContentType 'application/json' -ErrorAction Stop
$importResponse | Select-Object -Property * -ExcludeProperty 'passphrase' | Write-Verbose
Write-Verbose "Successfully certificate '$F5CertificateName.pfx'"
# Delete the file we uploaded above since it's no longer needed on the appliance
$deleteBody = [ordered]@{"command" = "run"
"utilCmdArgs" = " -c `"rm -f $($uploadResponse.localFilePath)`""
} | ConvertTo-Json -Compress
Write-Verbose "Deleting .pfx from appliance with $($deleteBody)"
$deleteResponse = Invoke-RestMethod -Uri "https://$F5Appliance/mgmt/tm/util/bash" -Method POST -Body $deleteBody -Headers $f5AuthHeader -ContentType 'application/json' -ErrorAction Stop
$deleteResponse | Select-Object -Property * | Write-Verbose
NimbostratusThank you, jakauppila , for your feedback. It's great that you have a workaround for this problem.
I am observing a bit of a different issue than the one listed in the bug.
I am using tmsh. When the certificate is going to be installed in the scope of the transaction, the following error occurs:
# (echo create cli transaction; echo install sys crypto cert test-cert.crt from-local-file /tmp/test-crt.crt; echo submit cli transaction) | tmsh
transaction failed: 01070712:3: file (/var/system/tmp/tmsh/X0rwba/test-crt.crt) expected to exist.I set the `from-local-file` option to `/tmp/test-cert.crt, but the error reads that file (/var/system/tmp/tmsh/X0rwba/test-cert.crt) expected to exist.
The certificate is installed successfully when the command is launched outside of the transaction.
# tmsh install sys crypto cert test-cert.crt from-local-file /tmp/test-cert.crt;
# tmsh list /sys crypto cert test-cert2crt
sys crypto cert test-cert.crt {
...
}