Forum Discussion

RCarman's avatar
RCarman
Icon for Nimbostratus rankNimbostratus
Aug 04, 2015

Certificate bundles in LTM 11.6

I'm getting ready to migrate to LTM v11 from LTM v10.2.4. In LTM v10.2.4 I have been able to manage the certificate bundles that I've created from various CA certificates that are DoD approved by using the BASH shell and some Perl scripts. This lets me "unbundle" a certificate bundle file, delete any expired CA certificate(s), then rebundle the certs into a bundle file and copy it back to /config/ssl/ssl.crt. This way I don't have to change any profiles that employ these certificate bundles - I just overwrite the file in /config/ssl/ssl.crt - thus keeping the same file name.

 

With LTM v11, the certificates are stored in a new location and they have a fancy new naming structure. So, creating certificate bundles and copying them to /config/ssl/ssl.crt doesn't seem to function the way it did in LTM v10.2.4.

 

I need to discover how I can manage these certificate bundles in LTM v11. I noticed that there are a couple of certificates that are stored in /config/ssl/ssl.crt and have a symlink created in /config/filestore/files_d/Common_d/certificate_d that points to them. It seems like that would solve my dilemma, but I'm not sure how those symlinks were created. It doesn't work when I do it manually (i.e. I can create the symlink manually, but LTM doesn't seem to "see" the certificates in the Web GUI.)

 

Any ideas?

 

1 Reply

  • You can copy the certs/keys/bundles on the device and then install them in the filestore via the following command ..

    tmsh install sys crypto ..

    The command-line help is pretty straight-forward.

    I recommend you do not try to place the files or replace any symlinks outside of these commands.

    cheers.