Skip to content

Provision certificates to F5 Distributed Cloud

Provision a certificate from Certificate Manager - SaaS to a certificate object in an F5 Distributed Cloud namespace. Certificate Manager - SaaS creates the certificate object or updates it if it already exists, and it can also bind the certificate to an HTTP load balancer.

Before you begin

  • An F5 Distributed Cloud machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • An existing F5 Distributed Cloud namespace to hold the certificate object.

To provision a certificate to F5 Distributed Cloud

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in Namespace, enter the F5 Distributed Cloud namespace where you want the certificate object, such as default.

  6. In Certificate Object Name, enter the name of the certificate object. If an object with this name already exists in the namespace, Certificate Manager - SaaS replaces its certificate. Otherwise, Certificate Manager - SaaS creates the object.

    Note

    Namespace, Certificate Object Name, and Load Balancer Name accept only lowercase letters, digits, and hyphens, can't start or end with a hyphen, and can be up to 199 characters long.

  7. (Optional) Under Installation Endpoint, in Load Balancer Name, enter the name of an HTTP load balancer in the same namespace to bind the certificate to. Leave it empty to only create or update the certificate object.

    • If the load balancer exists, Certificate Manager - SaaS adds the certificate object to the load balancer's HTTPS certificates, or replaces the reference if the object is already there. The load balancer's other certificates stay in place.
    • If no load balancer has that name, Certificate Manager - SaaS creates a new HTTP load balancer with that name. It serves the certificate's first Subject Alternative Name (SAN), or its common name if there's no SAN, over HTTPS on port 443, and it's advertised on the public default virtual IP address (VIP).

    Warning

    A mistyped or new name in Load Balancer Name creates a new load balancer that's reachable from the internet. Check the name against the load balancers in the namespace before you save.

  8. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  9. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. When the certificate is pushed, Certificate Manager - SaaS uploads the certificate, its issuing chain, and its private key to the certificate object, and then binds it to the load balancer if you entered one. Load balancers that already reference the certificate object use the new certificate immediately, without a manual upload or a load balancer restart. To provision on a schedule instead of right away, set up a machine provisioning schedule.