Barracuda WAF¶

Use this procedure to provision a certificate from Certificate Manager - SaaS to a Barracuda Web Application Firewall (WAF) and activate it on a service.

Certificate Manager - SaaS provisions RSA and ECDSA server certificates. Trusted CA, trusted server, and self-signed certificates are discovered but can't be provisioned.

1. Sign in to Certificate Manager - SaaS.

2. Click Installations > Machines.

3. Click the more options button at the right end of the Barracuda WAF machine's row, and then select Provision.

4. In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.

   Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.

5. Under Certificate Information, in Certificate Name, enter the name to store the certificate under on the appliance.

   Note

   Certificate Manager - SaaS adds a fingerprint suffix to the name, for example web-prod-3f9a1c07b2e4. The suffix is the first 12 characters of the certificate's SHA-256 fingerprint, so it doesn't match the Certificate SHA1 Fingerprint you reviewed when selecting the certificate. The same certificate always gets the same name, so retrying a provision reuses the existing certificate. A renewed certificate gets a new name.

   In the name you enter, letters, numbers, hyphens, and underscores are kept, and each run of other characters becomes a single hyphen. If the full name would be longer than 64 characters, Certificate Manager - SaaS shortens the part you entered so the suffix still fits.

6. From Certificate Type, select Signed Certificate.

   Note

   Certificate Manager - SaaS always stores provisioned certificates as signed certificates. The other types in this list identify certificates found during discovery.

7. Under Server Store Details, from Binding Type, select where on the appliance to use the certificate:

   • Service Default Certificate: The service's default certificate.
   • SNI Domain Certificate: The certificate for one domain on a service that serves several domains.
   • Unbound: Uploads the certificate to the appliance without activating it on a service.

8. If you selected any binding type other than Unbound, enter the following:

   • Service: The service (web application) to activate the certificate on.
   • Vsite: The vsite (appliance partition) that the service belongs to. Provisioning fails if the service isn't in this vsite.
9. If you selected SNI Domain Certificate, enter the domain in Domain. If the domain isn't already configured on the service, Certificate Manager - SaaS adds it.

10. If you selected any binding type other than Unbound, from Certificate Slot, select RSA or ECDSA.

    Important

    Select the slot that matches the certificate's key type. Provisioning fails if they don't match.

11. (Optional) To save without pushing the certificate now, turn off Push certificate on save. It's on by default.

12. Click Save.

    Tip

    You can schedule your provisions daily, weekly, or monthly. See Provision certificates.

After saving, Certificate Manager - SaaS uploads the certificate to the appliance, activates it on the service or domain you selected, and creates an installation record on the Installations tab. Other certificate assignments on the service stay unchanged.