version 21.1 ACME setup for certificate renewal with Digicert

A little late to the conversation, but please also review the following article: 

Automatic Certificate Management with ACMEv2 in F5 BIG-IP | DevCentral

I will also provide some additional guidance inline below.

Step 1: Create an HTTP virtual server:

The ACMEv2 HTTP-01 validation requires that the ACME be able to challenge an HTTP:80 listener on the IP address resolved from public DNS. Your BIG-IP needs an HTTP:80 VIP that will listen for this challenge request and respond with a token provided by the ACME server at the beginning of the transaction. For BIG-IP ACMEv2 support you simply need an LTM VIP listening on port 80, with an HTTP profile attached, and the "ACMEv2 Challenge" option enabled. 

Navigate to Local Traffic --> Virtual Servers

tmsh create ltm virtual www.f5labs.local \
destination 10.1.10.120:80 \
profiles replace-all-with { tcp http } \
acmev2-challenge enabled \
vlans replace-all-with { client-vlan } \
vlans-enabled

This will handle requests to /.well-known/acme-challenge. If the HTTP:80 VIP is also used to auto-redirect to the HTTPS site, you'll need to modify the redirect iRule to ignore this URL.

when HTTP_REQUEST {
    if { !([HTTP::uri] starts_with "/.well-known/acme-challenge") } {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
}

---------------------------

Step 2: Create a DNS resolver

The resolver is used here to provide a resolution path for the ACME client to find the ACME service(s) and is attached to an internal proxy object.

Navigate to Network --> DNS Resolvers

tmsh create net dns-resolver acme-resolver \
{ forward-zones replace-all-with \
{ . { nameservers replace-all-with { 10.1.10.53:53 }}}}

---------------------------

Step 3: Add an ACME CA bundle

The CA bundle is needed to validate the TLS communications with the ACME service. For an Internet ACME service, like Lets Encrypt, it may be sufficient to use the built-in "ca-bundle" or "blended-bundle".

Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List

---------------------------

Step 4: Create the ACME account key

The ACME account key is used to create an account registration with the ACME service. This is typically just a self-signed certificate. For ACME services that require EAB you'd still create this key, but EAB would be used for "pre-authentication".

Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List

tmsh create sys crypto key acme-account-key

tmsh create sys crypto cert acme-account-key \
key acme-account-key \
common-name acme-account-key \
subject-alternative-name DNS:acme-account-key

---------------------------

Step 5: Create the internal proxy object

The internal proxy provides the routing path to the ACME service on the BIG-IP data plane, and supports both routed and explicit proxy connectivity.

Navigate to System --> Services --> Internal Proxies

tmsh create sys internal-proxy acme-proxy { dns-resolver acme-resolver route-domain 0 }

---------------------------

Step 6: Create an ACME provider

An ACME provider defines how to connect to a specific ACME service (ex. Lets Encrypt), and includes the directory URL path and any authentication requirements.

Navigate to System --> Certificate Management --> Traffic Certificate Management --> ACME Provider List

tmsh create sys crypto acme-provider acme-provider-letsencrypt \
internal-proxy acme-proxy \
trusted-ca-cert acme-bundle \
directory-url https://acme-staging-v02.api.letsencrypt.org/directory \
account-key acme-account-key \
challenge-type { http-01 } \
accepted-tos true \
account-action activate

---------------------------

Step 7: Generate a certificate from CSR

You can now generate an ACME request directly from a key and CSR.

Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List

tmsh create sys crypto \
key www.f5labs.local \
gen-csr www.f5labs.local \
common-name www.f5labs.local \
subject-alternative-name DNS:www.f5labs.local \
organization f5labs.local \
city omaha \
state ne \
country us \
key-type rsa-private \
key-size 2048 \
key-usage "keyAgreement,digitalSignature,keyEncipherment" \
acme-provider add { acme-provider-letsencrypt { order-type new identifiers none } }

You can also spawn an ACME renewal directly from an existing cert/key. Open/edit a cert/key object, go to the key tab, select an ACME provider, and set ACME order Type to 'New' or 'Renew' and then click the Update button. Periodically click the Refresh button to check the status.

Thanks.

Hi awan_m​,

take a look here:

https://techdocs.f5.com/en-us/bigip-21-1-0/big-ip-system-ssl-administration/ssl-certificate-management.html#acme-provider-setup

KR
Daniel

thanks for the reply - but none of these help with setting up Acme agent that is now on F5 - the video and document are for digicert sensor implementation 

Hey awan_m​ 

See if it helps you to start with.

https://www.youtube.com/watch?v=nee8F4Pt4Vc 

https://docs.digicert.com/de/trust-lifecycle-manager/integration-guides/f5-big-ip-ltm-integration.html