Skip to content

Barracuda ADC

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Use this procedure to provision a certificate from Certificate Manager - SaaS to a Barracuda Load Balancer ADC and assign it to a service.

Before you begin, make sure that SSL offloading is enabled on the target service. For an SNI binding, SNI must also be turned on for the service, and the domain must already exist in its SNI domain list. Otherwise provisioning succeeds but the appliance doesn't serve the certificate. Certificate Manager - SaaS doesn't create or enable services, TLS configuration, or SNI domains.

Important

Assigning a certificate to a service disconnects users who are currently connected through that service. Schedule provisioning for a time when this is acceptable.

  1. Sign in to Certificate Manager - SaaS.

  2. Click Installations > Machines.

  3. Click the more options more options button at the right end of the Barracuda ADC machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.

    Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.

  5. Under Certificate Information, in Certificate Name, enter the base name to store the certificate under on the appliance. The default is venafi-cert.

    Note

    Certificate Manager - SaaS appends a short fingerprint to the name, for example venafi-cert-3f9a1c07b2e4. The same certificate always gets the same name, so retrying a provision reuses the existing certificate. A renewed certificate gets a new name.

  6. From Key Type, select RSA or ECDSA.

    The appliance stores RSA and ECDSA certificates in separate slots, so one service can serve both. When you provision an ECDSA certificate, Certificate Manager - SaaS also turns on ECDSA for the service if it's off. Without it, the service doesn't serve the certificate.

  7. From Certificate Type, select one of the following:

    • Signed Certificate for a server certificate.
    • Trusted Certificate for a CA certificate that the service uses to validate connecting clients.

    Important

    Certificate Type must match the Binding Type you select in the next section. Select Signed Certificate for a Default Certificate or SNI Domain binding, and Trusted Certificate for a Client Validation Certificate binding. If they don't match, provisioning fails after the certificate is already uploaded, and the certificate stays on the appliance without being assigned to a service. Remove it in the appliance's web interface, correct Certificate Type, and provision again.

  8. (Optional) To let the appliance export the private key of this certificate, turn on Allow Private Key Export. This setting is off by default.

    Warning

    When this setting is on, anyone with the appliance's REST API credentials can download the certificate as a PKCS#12 file that contains its private key, and the appliance provides no way to delete the certificate afterward. When the setting is off, downloads are limited to PEM, but according to Barracuda, you can't take a backup of the system configuration.

  9. Under Server Store Details, from Binding Type, select where on the appliance to assign the certificate:

    • Default Certificate: The service's default certificate.
    • SNI Domain: The certificate for one domain on a service that serves several domains.
    • Client Validation Certificate: A CA certificate that the service trusts when it validates connecting clients.
    • Unbound: Uploads the certificate to the appliance's certificate store without assigning it to a service.

  10. If you selected any binding type other than Unbound, enter the following:

    • Service Group: The service group that contains the service.
    • Service: The virtual service to assign the certificate to.
  11. If you selected SNI Domain, enter the domain in SNI Domain. The domain must already exist in the service's SNI domain list.
  12. (Optional) To save without pushing the certificate now, turn off Push certificate on save. It's on by default.

  13. Click Save.

    Tip

    You can schedule your provisions daily, weekly, or monthly. See Provision certificates.

After saving, Certificate Manager - SaaS uploads the certificate to the appliance and assigns it to the service or domain you selected. It then reads the service configuration back to confirm the change took effect, and creates an installation record on the Installations tab. Other settings on the service stay unchanged.

Note

Keep the following in mind when provisioning to a Barracuda ADC:

  • The appliance can't replace or delete certificates through its API, so each renewal adds a new certificate to the appliance's store. The previous certificate remains on the appliance. To remove old certificates, use the appliance's web interface.
  • When you renew a Client Validation Certificate, Certificate Manager - SaaS replaces only its own previous version in the service's trusted certificate list. CA certificates that were added in other ways stay in the list.
  • If the appliance reports that a certificate with the same name but a different chain already exists, remove that certificate in the appliance's web interface and provision again.
  • Avoid provisioning to the same appliance from more than one VSatellite at the same time. The appliance's API can't detect conflicting changes.