Automating ACMEv2 Certificate Management on BIG-IP

By virtue of the http-01 validation process, the cert subject has to be resolvable by public DNS, and that resolved IP has to have an HTTP:80 listener on the public Internet that the ACMEv2 server can get to. And since a BIG-IP mgmt. UI should never be exposed to the Internet, it really isn’t practical to renew device certs this way. That said, there are at least two options worth mentioning:

• Manage the cert in the traffic certs section, do dns-01 validation (doesn’t require an Internet HTTP:80 listener), and then use a separate script on the BIG-IP to move that updated cert from traffic certs section to device cert. Kojot would behave the same, you’d just need this additional script to move the new cert to device.
• Host an internal ACMEv2 service and dns-01 – this solves for the public Internet access issue with http-01. You’d still need the script to move from traffic certs to device.

As Kevin rightly pointed out, using the ACME protocol—particularly the http-01 challenge—for renewing the BIG-IP management certificate is not practical. 

While the dns-01 challenge offers a workaround (by validating ownership via DNS rather than HTTP), it still doesn’t directly solve the problem. Lot of devices does not have the hostname provided on the DNS server.

That said, there is a more suitable solution available:

A better and more secure alternative is to use a script-based approach that leverages the EST (Enrollment over Secure Transport) protocol. This method allows you to:

• Authenticate securely to your internal certificate authority.
• Request and retrieve new certificates over HTTPS.
• Automatically install the renewed certificate on the BIG-IP management interface.

This avoids public exposure and can be fully automated in environments where an internal PKI with EST support is available (e.g., Microsoft ADCS with EST proxy, EJBCA, etc.).

If you’re managing BIG-IP devices at scale or aiming for a hands-off certificate lifecycle, this approach is recommended.