F5 BIG-IP LTM¶

You can present the certificate on an application traffic SSL profile, or on the device administration page. When you provision to an application traffic SSL profile, you can use an existing SSL profile on your F5, or you can use Certificate Manager - SaaS to create a new SSL profile for you. The steps below walk you through these scenarios.

1. Sign in to Certificate Manager - SaaS.
2. Click Installations > Machines.
3. Click the checkbox next to the F5 BIG-IP LTM machine that you want to provision a certificate to.
4. Click Provision a certificate.

5. From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

   Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

6. In the Certificate Name field, enter the name for this certificate as you want it to appear on your F5.

   What if the name is already in use on the F5?

   When provisioning a certificate to the F5, Certificate Manager - SaaS checks to see if the name you enter in this field is already in use.

   • If the name you enter isn't in use, Certificate Manager - SaaS will use it.
   • If the name is in use, Certificate Manager - SaaS checks to see if it's the same certificate. If so, Certificate Manager - SaaS uses the certificate that is already on the F5.
   • If the name is in use, but it's a different certificate, then Certificate Manager - SaaS creates a new certificate. A unique certificate name will be generated using a combination of the certificate name entered in this field, the expiration date from the certificate, and a unique numerical value, such as my-cert-name_22Oct05_3117.

7. (Optional) In the Chain Bundle Name field, enter the name for the CA certificate bundle as you want it to appear on your F5. If your SSL profile does not use a chain bundle, leave this field blank.

   Note

   If you leave the Chain Bundle Name blank, Certificate Manager - SaaS provisions the certificate and key without creating or modifying any chain bundle on the F5. The SSL profile's existing chain setting is left unchanged.

   When you provide a Chain Bundle Name, the following scenarios and results apply:

   • If the bundle does not exist, then we create the bundle with the issuing certificates.
   • If the bundle already exists and matches exactly (with the same number of issuing certificates in the same order and containing the same certificates), no changes are made to the F5. The provisioning process proceeds as if Certificate Manager - SaaS created it.
   • If the bundle exists and has any of the three listed scenarios, the operation will fail with the error message cannot overwrite existing certificate chain.
     • (1) different issuing certificates
     • (2) the same certificates but in a different order
     • (3) it has the same certificates but contains additional certificates. For example, if we want to add certificates Root, Intermediate1, and Intermediate 2, but the existing bundle already includes an additional Intermediate 3.

8. From the Binding Type drop-down, select where you want the certificate to be presented:

   • Application Traffic (SSL Profile) – Presents the certificate on a client SSL or server SSL profile that handles application traffic. This is the default.
   • Device Administration – Presents the certificate on the device administration page, which is served by the F5 management web service (httpd).

   Note

   The fields that follow change based on which option you choose here, except Partition, which applies to both. Installations created before Binding Type was added continue to use Application Traffic (SSL Profile).

9. (Application Traffic only) From the Profile Type drop-down, select either Client SSL Profile or Server SSL Profile, depending on the type of F5 profile you're provisioning to.

10. In the Partition field, enter an F5 partition name. This partition must already exist on the F5. Leaving this field blank will default to the F5's Common partition.

    Note

    The partition name is case sensitive.

11. (Application Traffic only) In the Parent Profile field, enter the name of the parent profile you want to associate with the SSL Profile.

    Note

    If you're using an existing SSL Profile in the next step, this field will be ignored. Certificate Manager - SaaS will not modify the parent profile of existing SSL profiles.

12. (Application Traffic only) In the SSL Profile field, enter an SSL profile name. This can be either a name that is already in use on the F5 partition, or a new name.

    What happens if the name is already in use?

    If the profile name you enter already exists in the F5 partition you entered previously (see the Partition step above), then Certificate Manager - SaaS will provision the certificate to that profile. Otherwise, Certificate Manager - SaaS creates a new profile using the name you enter here.

13. (Application Traffic only) For Client SSL Profiles, you can optionally enter an alternative DNS name for Server Name Indication in the SNI field.

    Warning

    If you're editing an existing SSL profile, any current Server Name value will be overwritten if you enter a value here.

    Note

    The Virtual Server Friendly Name(s) list shows the virtual servers on the F5 machine that currently use the SSL profile you entered. Because an SSL profile can be applied to multiple virtual servers, this list helps you verify that you’re provisioning the certificate to the correct profile.

14. (Device Administration only) To make the new certificate take effect immediately, select Restart the HTTP service. Certificate Manager - SaaS restarts the F5 management web service (httpd) after it installs the certificate, and then confirms that the service comes back online.

    Warning

    Restarting the service briefly disconnects the F5 management session. Anyone signed in to the F5 management interface is signed out and must sign in again.

    Note

    If you leave Restart the HTTP service as its default setting (cleared), the certificate is installed but is not presented until the next time the httpd service restarts.

15. If you don't want the certificate to be pushed when you save, toggle the Push upon saving slider to No.

16. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After saving, the certificate is pushed to the F5 and an installation is created on the Installations tab. For Application Traffic (SSL Profile) bindings, the certificate is pushed to the SSL profile that you specified; if you created a new SSL profile, that profile is now ready to be assigned to a virtual server or HTTPS health monitor on the F5. For Device Administration bindings, see Provisioning to the device administration page.

Provisioning to the device administration page¶

When you select Device Administration, Certificate Manager - SaaS installs the certificate and private key onto the files that the F5 management web service (httpd) serves. The F5 configuration already points to these files, so no further configuration is required on the device.

When you provision to the device administration page, note the following:

• Provisioning to the device administration page requires an F5 account with administrator permissions. If the account does not have them, provisioning fails with a message stating that administrator permission is required.
• Before overwriting the files, Certificate Manager - SaaS archives the current certificate and key on the device in /var/tmp. The archive is readable only by its owner, because it contains the management private key.
• Certificate Manager - SaaS keeps the three most recent archives on the device and removes older ones.
• If the certificate is written but the private key cannot be, Certificate Manager - SaaS restores the archive it created at the start of the operation so that the management web service can still start, and reports provisioning as failed. You should retry it. Recovery depends on that archive:
  • If the restore succeeds, the device keeps its previous certificate and key.
  • If the restore fails, the error message names the archive to restore manually.
  • If no archive was created at the start (archiving is best-effort), Certificate Manager - SaaS cannot roll back automatically; the error message tells you to restore the previous certificate and key manually before the next httpd restart.
• Certificates that secure the device administration page are not returned by machine discovery. Discovery reports certificates that are bound to application traffic SSL profiles.