AS3 3.44.0 - ChainCA invalid x509 - Certificate-bundle.crt

[rdegoix]

Dear people,

Environment

• Application Services Version: 3.44.0
• BIG-IP Version: BIG-IP 17.1.1.3 Build 0.0.5 Point Release 3
• Deploying through BIG-IQ to my F5 BIG-IP

Summary

It looks like when using AS3 declaration with chainCa : "MyIntermediateCertificate", it's giving issue with invalid x509 file. And it's complaining about another Certificate-bundle.crt, that could be the one by default in F5 BIG-IP (but no the one that I uploaded previously, my current certificate is signed by an official CA (I also tried with other one : VerySign.... same issue)

If I remove the chainCa, AS3 deployment working properly.

pwd /config/ssl/ssl.crt

ls -lh

total 3.5M -rw-r--r--. 1 root root 3.5M Mar 21 2024 ca-bundle.crt -rw-r--r--. 1 root root 1.4K Aug 20 12:41 default.crt -rw-------. 1 root root 1.3K Aug 26 17:47 dtca-bundle.crt -rw-------. 1 root root 1.3K Aug 26 17:47 dtca.crt -rw-------. 1 root root 1.3K Aug 26 17:47 dtdi.crt -rw-r--r--. 1 root root 2.0K Oct 28 11:21 f5_api_com.crt -rw-r--r--. 1 root root 2.2K Mar 21 2024 f5-ca-bundle.crt -rw-r--r--. 1 root root 1.7K Mar 21 2024 f5-irule.crt

When doing same stuff through the F5 BIG-IP GUI, working properly.

Steps To Reproduce

Steps to reproduce the behavior:

1. Submit the following declaration:

 {
    "class": "AS3",
    "schemaVersion": "3.44.0",
    "action": "patch",
    "patchBody": [
      {
        "class": "ADC",
        "target": {
          "address": "X.X.X.X"
        },
        "op": "add",
        "path": "/Automation/APP_TEST_1.2.12.140_446",
        "value": {
          "class": "Application",
          "remark": "REFERENCE : NULL_REFERENCE_20241108140113",
          "schemaOverlay": "AS3-F5-HTTPS-offload-lb-existing-cert-template-big-iq-default-v2",
          "template": "https",
          "serviceMain": {
            "pool": "HTTPS_443_pool",
            "enable": true,
            "serverTLS": "HTTPS_443_client_ssl",
            "virtualPort": 446,
            "profileAnalytics": {
              "use": "Analytics_Profile"
            },
            "virtualAddresses": [
              "1.2.12.140"
            ],
            "persistenceMethods": [],
            "class": "Service_HTTPS"
          },
          "HTTPS_443_pool": {
            "members": [
              {
                "adminState": "enable",
                "servicePort": 443,
                "serverAddresses": [
                  "1.2.12.10"
                ]
              }
            ],
            "monitors": [
              {
                "use": "HTTPS_443_monitor"
              }
            ],
            "loadBalancingMode": "least-connections-member",
            "class": "Pool"
          },
          "HTTPS_443_monitor": {
            "send": "GET /\r\n",
            "receive": "none",
            "receiveDown": "",
            "adaptiveWindow": 180,
            "adaptiveLimitMilliseconds": 1000,
            "adaptiveDivergencePercentage": 100,
            "adaptiveDivergenceMilliseconds": 500,
            "class": "Monitor"
          },
          "HTTPS_443_client_ssl": {
            "certificates": [
              {
                "certificate": "Certificate"
              }
            ],
            "class": "TLS_Server"
          },
          "Certificate": {
            "certificate": {
              "bigip": "/Common/certif_customer.crt"
            },
            "chainCA": "/Common/intermediate.crt",
            "privateKey": {
              "bigip": "/Common/certif_customer.key"
            },
            "pkcs12Options": {
              "keyImportFormat": "pkcs8"
            },
            "class": "Certificate"
          },
          "Analytics_Profile": {
            "collectIp": false,
            "collectGeo": false,
            "collectUrl": false,
            "collectMethod": false,
            "collectUserAgent": false,
            "collectOsAndBrowser": false,
            "collectPageLoadTime": false,
            "collectResponseCode": true,
            "collectClientSideStatistics": true,
            "class": "Analytics_Profile"
          }
        }
      }
    ]
  }

2. Observe the following error response:

  "as3_response": {
    "content": "{\"code\":422,\"message\":\"**status:422**, body:{\\\"results\\\":[{\\\"message\\\":\\\"Failed to send declaration: /declare failed with status of 422, ****declaration failed 01070712:3: unable to validate certificate, invalid x509 file**** (/Automation/APP_TEST_1.2.12.140_446/Certificate-bundle.crt)

Expected Behavior

It should deploy AS3 declaration with TLS client profile including chainCA as requested.

Actual Behavior

422 due to invalid x509 file

[rdegoix]

Sorry for missunderstanding :

it looks like BIG-IQ is running AS3 3.44.0 : curl -sk -H "Content-Type: application/json" -H "X-F5-Auth-Token: $TOKEN" -X GET "https://$BIGIQ_MGMT/mgmt/shared/appsvcs/info" {"version":"3.44.0","release":"3","schemaCurrent":"3.44.0","schemaMinimum":"3.0.0"}

My F5 BIG-IP target :

pwd

/var/config/rest/iapps/f5-appsvcs

cat version

3.44.0-3

But regarding deployment itself from BIG-IQ, I got a different schemaversion : schemaVersion": "3.12.0"

{ "id": "autogen_a4c95a0f-13e3-4078-92c3-3a8e6ea6f10c", "class": "ADC", "controls": { "class": "Controls", "userAgent": "BIG-IQ/8.3 Configured by API" }, "Automation": { "class": "Tenant", "APP_TEST_1.2.12.139_446": { "class": "Application", "remark": "REFERENCE : NULL_REFERENCE_20241109201819", "template": "tcp", "serviceMain": { "pool": "/Automation/APP_TEST_1.2.12.139_446/HTTPS_443_pool", "class": "Service_TCP", "enable": true, "profileTCP": { "use": "/Automation/APP_TEST_1.2.12.139_446/HTTPS_443_tcp_profile" }, "virtualPort": 446, "virtualAddresses": [ "1.2.12.139" ], "persistenceMethods": [ "source-address" ], "profileAnalyticsTcp": { "use": "/Automation/APP_TEST_1.2.12.139_446/Analytics_TCP_Profile" } }, "HTTPS_443_pool": { "class": "Pool", "members": [ { "adminState": "enable", "shareNodes": true, "servicePort": 443, "serverAddresses": [ "1.2.12.13" ] } ], "monitors": [ { "use": "/Automation/APP_TEST_1.2.12.139_446/HTTPS_443_monitor" } ], "loadBalancingMode": "least-connections-member" }, "HTTPS_443_monitor": { "send": "GET /\r\n", "class": "Monitor", "receive": "none", "targetPort": 443, "monitorType": "http", "adaptiveWindow": 180, "adaptiveLimitMilliseconds": 1000, "adaptiveDivergencePercentage": 100 }, "Analytics_TCP_Profile": { "class": "Analytics_TCP_Profile", "collectCity": false, "collectRegion": true, "collectCountry": true, "collectNexthop": false, "collectPostCode": false, "collectContinent": true, "collectRemoteHostIp": false, "collectedByClientSide": true, "collectedByServerSide": true, "collectRemoteHostSubnet": true }, "HTTPS_443_tcp_profile": { "class": "TCP_Profile", "synMaxRetrans": 3, "finWaitTimeout": 5 } } }, "updateMode": "selective", "schemaVersion": "3.12.0" }