Is it possible to generate a self-signed SSL certificate with SHA1 under version 11.6?

Question

I have a weird issue where I need to set up a temporary certificate using the SHA1 hash. It looks like SHA2 is now used by default if the cert is generated from the GUI. I've trolled through the TMSH commands and I don't see where I can specify the signing hash using the console.&nbsp;
Is this doable? (I know SHA1 is deprecated; this isn't by my choice.)&nbsp;

ltwagnon · Answer

Here's an article that might help: https://devcentral.f5.com/articles/big-ip-ssl-cipher-history&nbsp;

rdessert_76127 · Answer

Did you figure it out?  I have an old application that requires SHA1 (not my choice as you stated) and it appears that the UI doesn't allow you to specify as you said.

boneyard · Answer

i doubt you can do it via the GUI, but this article can be used as a basis to do it via the CLI (not tmsh though)&nbsp;
http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7754.html&nbsp;
i assume openssl will just default to sha-1, if not you might have to enforce that with the correct flag.&nbsp;

Forum Discussion

Is it possible to generate a self-signed SSL certificate with SHA1 under version 11.6?

3 Replies

Recent Discussions

preserve client IP on layer 4 VIP

Failed to convert character dclid=%EDclid!

ASM - Parent policy vs OWASPcompliance

Rewrite uri translation not working

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

Related Content

Changing self-signed device certificate impact

Web Services, SSL, and self-signed server certificates

Re: Management Certificate

My Security+ Certification Journey

Certifications for security professionals