Last Modified: Jul 18, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
11.5.4, 11.5.4 hf1, 11.5.4 hf2, 11.5.4 hf3, 11.5.4 hf4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10
Opened: Sep 06, 2016 Severity: 3-Major
1. Using the GUI or an iControl SOAP call can create invalid client SSL profile containing an empty cert-key-chain. This might occur after following these steps: -- Create new client-ssl cert from the GUI (the web-based UI). -- Check 'Custom' in 'Certificate Key Chain', but do not add anything. -- Click Finished. The system creates the following: ltm profile client-ssl /Common/cssl { app-service none cert none cert-key-chain { "" { } defualt_rsa_ckc { <=== a typo "defualt" cert /Common/default.crt key /Common/default.key } } <snip> } 2. Using the iControl function 'LocalLB::ProfileClientSSL::create_v2' creates a profile with two cert-key-chain objects containing identical cert and key values, but with different names: ltm profile client-ssl my_prof { app-service none cert mycert.crt cert-key-chain { "" { cert mycert.crt key mycert.key } defualt_rsa_ckc { <=== a typo "defualt" cert mycert.crt key mycert.key } } chain none inherit-certkeychain false key mycert.key passphrase none }
Cannot add the invalid client SSL profile to a virtual server.
Creating client SSL profiles using the GUI or the iControl function create_v2().
Remove the invalid client SSL profile and re-create the profile using TMSH or the GUI.
None