Bug ID 629095: iControl keymanagment impory may fail when stale content exists in /config/ssl

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
11.6.1, 11.6.2, 11.6.3,,,,, 11.6.4, 11.6.5,,,, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3,,,,,,,, 12.1.4,, 12.1.5,,,, 12.1.6, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1

Fixed In:

Opened: Nov 17, 2016

Severity: 3-Major

Related Article: K08240314


iControl returns fault similar to "Keys do not match" when respective key/cert does not exist in the filestore.


Unable to import cert/key with particular name while /config/ssl contains stale content.


Stale cert/key in /config/ssl which matches the name of the cert/key being imported. For example, iControl attempting to import file as test.crt while /config/ssl/ssl.key contains test.key which does not match test.crt.


Remove the conflicting file from /config/ssl/ssl.{key,crt}.

Fix Information

A certificate being imported is now checked against contents in filestore to determine whether the contents in /config/ssl are stale.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips