Skip to content

Create a new Radware Cloud WAF machine

Creating a Radware Cloud WAF machine lets Certificate Manager - SaaS discover the TLS certificates in a Radware Cloud WAF account, and install renewed certificates on the applications that the account protects. Certificate Manager - SaaS connects to the Radware Cloud Services API directly with an API key, so you don't need a VSatellite. After you create the machine, you can provision certificates to it.

Before you begin

  • A Radware Cloud WAF account, and access to the Radware Cloud Portal.

  • An API key for the account. A user with the Account Users Admin role creates it in the Cloud Portal, under Accounts > API Keys. The key needs permission to:

    • Read certificates and applications.
    • Download certificates.
    • Upload certificates and assign them to applications.
    • Delete certificates, only if you turn on Certificate Cleanup with Delete.

  • The Application Protection ID of the account, a UUID. It's shown in the Cloud Portal under Accounts > API Keys > Account ID Details.

  • Shared credentials (optional): you can store the API key in your credential provider (CyberArk is the only credential provider currently supported by Certificate Manager - SaaS). To use this option, first set up the connection to CyberArk.

Note

Radware API keys expire. When a key expires, discovery and provisioning fail with an error that asks you to rotate the key. Create a new key in the Cloud Portal before the old one expires, and update it on the machine, or in your credential provider if you use shared credentials.

  1. In Application Protection ID (Tenant ID), enter the Application Protection ID of your account.

    Note

    Use the Application Protection ID, not the Infrastructure Protection ID, and not the account ID that's embedded in the API key. A wrong ID makes Test Access fail.

  2. (Optional) From the Credential Type drop-down, select either Enter Credentials or Select Credentials. Only users with the enabled "CyberArk shared credential" capability will see this option.

    Important

    Your view of credentials may be limited due to your role. System Administrators and PKI Administrators should be able to select any credential, but users with the Resource Owner role are restricted to using the credentials associated with their teams.

    Note

    • Enter Credentials - Is used to enter your API key manually.
    • Select Credentials - Is used to select your shared credentials from CyberArk. The credential's password is used as the API key.
    • If you choose Enter Credentials, proceed to the next step and enter your API key.
    • If you choose Select Credentials, select your shared credentials from the Credential drop-down, and then skip the next step.

  3. In API Key, enter the API key that you created in the Radware Cloud Portal.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  4. (Optional) From the Certificate Cleanup drop-down, select whether Certificate Manager - SaaS removes old certificates from your Radware account after it provisions a new one:

    • Off: Certificate Manager - SaaS never deletes certificates. This is the default.
    • Report only (delete nothing): Certificate Manager - SaaS logs the certificates that Delete would remove, and deletes nothing.
    • Delete: After Certificate Manager - SaaS confirms that an application serves the new certificate, it deletes up to five expired certificates that no application uses and that cover the application's main domain.

    Warning

    The cleanup can't tell certificates that Certificate Manager - SaaS uploaded from certificates that someone else uploaded. It deletes any certificate that meets its rules, including one that someone uploaded for a different host. A certificate qualifies if its common name (CN) or any of its SANs covers the application's main domain, so a wildcard or multi-domain certificate can qualify. For example, renewing www.example.com can delete an expired, unused *.example.com certificate that someone uploaded for api.example.com. A deleted certificate can't be recovered. Select Report only (delete nothing) first, review what it reports, and then switch to Delete.

  5. If you selected Report only (delete nothing) or Delete, enter the number of days a certificate must have been expired before the cleanup can delete it in Cleanup After Expiry (Days). The default is 30, and you can enter 1 to 3650.

    Note

    • The cleanup runs only when a provisioning assigns a new certificate to an application and Certificate Manager - SaaS confirms that the application serves it. It doesn't run when you provision a certificate that the application already serves, or when a provisioning fails. Until the next provisioning that assigns a new certificate, Report only (delete nothing) reports nothing, and switching to Delete has no effect. Each run stops after 30 seconds.
    • The cleanup doesn't delete a certificate that any application uses, the certificate the application served before this provisioning, or a certificate that's still within the waiting period. A replaced certificate therefore stays in Radware for the rest of its validity plus this number of days, and a later renewal for the same domain removes it.
    • The cleanup is skipped while any application in the account uses an SNI certificate group.
    • The cleanup never changes the result of a provisioning. Certificates it doesn't remove stay in Radware until you delete them in the Cloud Portal.

  6. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.

    Note

    The test checks the API key, the Application Protection ID, and permission to read certificates and applications. It doesn't check the permission to download, upload, assign, or delete certificates. A key that can't download certificates passes the test, but every discovery fails. A missing upload or assign permission shows up during the first provisioning. If the test fails, check the API key, its expiration date, and the Application Protection ID.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. When you configure discovery, you can turn on Exclude expired certificates to skip certificates that have already expired.

Discovery reports each certificate in the Radware account, with the applications that use it. Each HTTPS service of an application (its main domain and front port) becomes an installation. A certificate that no application uses is reported once, as (unbound). Discovery supports up to 16,383 certificates in an account. If the account has more, every discovery fails with an error that says failed to spool the certificate list, and nothing is discovered. Expired certificates don't count toward the limit when Exclude expired certificates is on, so turning it on can bring the account under the limit.

For existing machines: