# F5 Venafi Solution for Enterprise Key and Certificate Management **URL:** \ **Category:** F5 Technical Articles\ **Tags:** big-iq, security\ **Created:** [October 10, 2019, 11:56am UTC](https://community.f5.com/t/f5-venafi-solution-for-enterprise-key-and-certificate-management/68174 "2019-10-10T11:56:45Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Srikanth7](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Srikanth7](https://community.f5.com/u/Srikanth7)\ **Post date:** [October 10, 2019, 11:56am UTC](https://community.f5.com/t/f5-venafi-solution-for-enterprise-key-and-certificate-management/68174/1 "2019-10-10T11:56:45Z")
## Solution Overview If you have deployed multiple [BIG-IP](https://f5.com/products/big-ip/local-traffic-manager.html) systems to protect your business applications, you know how complex—and important—the certificate and key management process is. Certificates and keys play a critical role in securing data and application identity, and any mismanagement represents a significant risk to security and overall operations. F5 has partnered with [Venafi](https://www.venafi.com/), the industry leader in machine identity protection, to develop a [BIG-IQ](https://www.f5.com/products/automation-and-orchestration/big-iq) based integrated solution that automates the certificate and key management lifecycle—creating certificate requests, retrieving and managing certificates and keys, and overseeing their distribution to multiple BIG-IP systems. This comprehensive solution enables our customers to simplify and centralize the control of this crucial process while maintaining high levels of security. ## Solution Deployment F5 BIG-IQ is at the core of this integrated solution, automating management of the entire key and certificate lifecycle. BIG-IQ establishes a secure control channel with Venafi Trust Protection Platform (TPP) for certificate signing requests and enrollment. Once the certificates are signed and received from Venafi TPP, BIG-IQ enables you to assign them to the virtual servers and securely provision them to BIG-IP systems. ![0EM1T000001MqNP.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/0cb2e7f5e6462a4a437e6363e7d9d0d8d085d346.jpeg) ### Bill of materials - F5 BIG-IQ, managing BIG-IP systems - Venafi Trust Protection Platform (TPP) ### Deployment Steps Before beginning the detailed configuration, we recommend verifying the network reachability and hostname resolution of Venafi TPP server from BIG-IQ. #### **Step-1: Add Venafi as third party CA provider in BIG-IQ** - From the BIG-IQ management GUI, click on the **Configuration** tab and navigate _to_ _ **LOCAL TRAFFIC \>\> Certificate** _ **_Management \>\> Third Party CA Management_.** - Click the **Create** button and select **Venafi** as the CA provider. - Enter the WebSDK URL and credentials to authenticate with Venafi. - Once configured, click the **Test Connection** button to verify BIG-IQ can reach Venafi TPP server. ![0EM1T000001MqNU.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/5/e/5e08dadecdeb1a2dc54eed4eb901debb04fbbc0f.png) - Click the **Save & Close** button. The Venafi provider you added appears in the list. - Click the **Edit Policy** link of the new Venafi provider you added. - In the **Policy Folder Path,** type the path of the Venafi TPP where the certificates and keys are located, and then click the **Get** button. - BIG-IQ populates the **Policy Folder List** with the policies to where BIG-IQ should send Certificate Signing Requests. At this point (or later), you have the option to rename the policies for easier identification by editing its nickname. - Click the **Save & Close** button. ![0EM1T000001Mr4J.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/4/9/493b8dfe97f63cc19b299c95d20cd61ebeeea049.png) #### **Step-2: Create a CSR to get a signed certificate from Venafi** - Navigate to _ **LOCAL TRAFFIC \>\> Certificate Management \>\> Certificates & Keys** _ and click on the **Create** button. - Select ‘Venafi’ as the **Issuer** , and the policy folder. - Specify the **Certificate and Key properties**. - Click the **Save & Close** button. BIG-IQ generates the CSR and sends it to Venafi TPP for signed certificates and keys. ![0EM1T000001MqNe.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/4/4c5dc6ef9b178edbb614c5ba572329d4d9e31bb8.png) You can now assign this imported certificate to your managed BIG-IP VE devices. #### **Step-3: Assign the certificate and key to the application** - Navigate to _ **LOCAL TRAFFIC \>\> Profiles.** _ Click the **Create** button. - Create a **Client SSL Profile** selecting the certificate and the key. - Once configured, click the **Save & Close** button ![0EM1T000001MqNj.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/02a3bbcc452928d8a0e61f44772308581c993c58.png) - Navigate to _ **LOCAL TRAFFIC \>\> Virtual Servers.** _ Click the **Create** button. - Create a virtual server and assign the client SSL profile. - Once configured, click the **Save & Close** button ![0EM1T000001MqNo.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/5/4/54428b132ea2518b6d512d663024c60922f4b5a5.png) ![0EM1T000001MqNt.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/f/a/faf3128c5bd31f1bec249a393f47735c827c77e1.png) #### **Step-4: Deploy the configuration to a target BIG-IP System** - Click on the **Deployment** tab and navigate to _ **EVALUATE & DEPLOY \>\> Local Traffic & Network.** _ - In **Deployment** section, Click the **Create** button. - Select the **Virtual Server** object and **Target Device** - BIG-IP system. Click the **Deploy** button. ![0EM1T000001MqNy.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/c/c6ad48abb7559c089b7e01309ba6d4de63e59b90.png) - Click on the configuration tab and navigate to _ **LOCAL TRAFFIC \>\> Virtual Servers.** _ You will see the virtual server has been successfully deployed to the target BIG-IP system. ![0EM1T000001MqO3.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/c/0/c0825686acd27915c488b3a8c3d5cbf8ac66025e.png) ## Summary As this demonstration shows, BIG-IQ not only offers a centralized management solution for BIG-IP systems, it also provides a one stop solution for key and certificate lifecycle automation through its integration with Venafi TPP. This simple, easy-to-deploy solution enables you to deliver secure applications more quickly and effectively, whether on-premises or on cloud. ## Additional Links - [Key and Certificate Management with F5 and Venafi (video)](https://youtu.be/-LfDKoMYa9Y) - [F5 BIG-IQ knowledge center](https://techdocs.f5.com/en-us/bigiq-7-0-0/integrating-venafi-for-certificate-management.html) - [Venafi marketplace](https://marketplace.venafi.com/apps/252332/f5-big-iq#!overview) ---
**Author:** ![MattM](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@MattM](https://community.f5.com/u/MattM)\ **Post date:** [January 16, 2020, 5:58pm UTC](https://community.f5.com/t/f5-venafi-solution-for-enterprise-key-and-certificate-management/68174/2 "2020-01-16T17:58:08Z")
​Looking to get some help with this integration.  I have followed the directions to a tee.  Question is this.  When the F5 BIGIQ submits the request to Venafi for a certificate, we usually have an approval workflow set up in Venafi and it may take up to an hour for someone to approve the certificate.  How will the F5 BigIQ handle this scenario?  Is it expecting an immediate response from the Venafi API or will it wait an check in?  Need some better documentation on this.  We also have our Venafi policy folders set to not allow users to submit their own. CSRS, we want the keys to be stored in Venafi.  But in this case the BIG-IP is submitting the CSR/key.  How will it handle that?  Any help is appreciated.