Skip to content
F5 Distributed CloudCertificate Management
Aa

xcsh — Configure

Configure steps

Section titled “Configure steps”

Prepare local inputs

Section titled “Prepare local inputs”
Terminal window
umask 077
mkdir -p "$XCSH_WORKDIR"
chmod 700 "$XCSH_WORKDIR"
cd "$XCSH_WORKDIR"

Native preparation independently validates the certificate/key pair and chain, retrieves public material, and encrypts the normalized key. Supply leaf-first <XCSH_CERT_FILE> and matching <XCSH_KEY_FILE>; choose an owned certificate name for XCSH_CERT_NAME. See Input variants for protected inputs.

Terminal window
xcsh blindfold certificate --cert "$XCSH_CERT_FILE" --key "$XCSH_KEY_FILE" \
  --name "$XCSH_CERT_NAME" -n "$XCSH_NAMESPACE" --output-file certificate1.json \
  > certificate1-prepared.json 2> certificate1-prepared.err
xcsh apply -f certificate1.json -n "$XCSH_NAMESPACE" --dry-run client -o json \
  > certificate1-preview.json 2> certificate1-preview.err

Expect prepared and a preview without a tenant write. Inspect certificate1-preview.json, then apply and reapply the identical saved manifest:

Terminal window
xcsh apply -f certificate1.json -n "$XCSH_NAMESPACE" -o json \
  > certificate1-apply.json 2> certificate1-apply.err
xcsh apply -f certificate1.json -n "$XCSH_NAMESPACE" -o json \
  > certificate1-reapply.json 2> certificate1-reapply.err

Expect created for a missing name, updated for changed configuration, and unchanged on identical reapply. Retain the saved manifest: preparing it again produces new randomized ciphertext.