F5 BIGIP & XC certbot plugin

nice! thanks for sharing with the community, emalzer​ !

The certbot-f5xc plugin can now also be used as an installer!

emalzer​ is there a way to make the plugin only upload to the active unit in a cluster?

If not, then it would be a great feature addition to the plugin 😄

hey! the plugin checks all bigips in the cluster and identifies which one is active for the provided VS. so, that should be already the case. did you observe otherwise?

Hey :-)

I just need to read your documentation where you write that you handle HA just nicely 😆

I'm waiting for a server to be setup for me, so I haven't tried it out just yet.

But can you help me understand two flags you have in your example:

"-a f5-bigip-auth" and "-i f5-bigip-inst" 

what do they mean?

sure! the ACME process is split into two parts: authentication and installation. so you can define how you wana do the authentication / validation part and how to do the installation. you can do both on the bigip and then you need to define the f5-bigip-auth-* and the f5-bigip-inst-* parameters. you can also for example do the validation / authentication via a public DNS provider (google, ...) and do the installation to the bigip. so you would need to apply the google-dns parameters and only the f5-bigip-inst-* parameters.

is it more clear to you now?

if you want, take a look into the https://gitlab.com/emalzer/certbot-ansible repo, there you can manage the required parameters for certbot via a yaml file and let ansible render a shell script that executes then the certbot commands with all the parameters.

Just to get to all the slow minds on board 😅

So, if I just want to install the certificate on the BigiP I only need f5-bigip-inst? And if I want to have the Bigip to be part of the certificate validation process I use f5-bigip-auth?

yes, true. if your certbot already has a certificate, you can just use the f5-bigip-inst parameters to install this existing and via certbot managed certificate to the bigip.

Hi again emalzer​ 

Is it correct that you are using basic auth when you upload the certificates?

I believe that if you change that to the token based auth instead you don't need to use a administrator for the task. JRahm​ can you confirm?

I have a customer which uses certificate vendor and they only need a certificate manager role to do the updating.

I also found this article (https://my.f5.com/manage/s/article/K000152667) which mentions that the 'certificate-manager' role cannot perform certificate management tasks via the API.