I am having trouble applying public certificates to my F5 LTM i2600 HA Pair

Forums Technical Forums
, ,
1

I manage an F5 LTM i2600 HA Pair running v17.5.1.3. I need to install public Sectigo ssl certificates to both nodes. I followed these instructions that I got from a Google Search (I dd not find any F5 documentation on this). Probably did not use the proper search criteria. I pasted the steps i followed below.

To update the F5 BIG-IP Configuration Utility (Web GUI) admin portal certificate with a Sectigo public certificate in an HA cluster, you must perform the steps individually on both uniquely named nodes. [1, 2]

Because the web administration portal relies on the Device Certificate (bound locally to the httpd daemon) rather than a Traffic profile, Device Certificates do not synchronize via ConfigSync. If you try to sync them, the unique names/IPs of the nodes will conflict.

Here is the exact step-by-step process for BIG-IP version 17.5.1.3:

Prerequisites

Ensure you have the following components from Sectigo for each node:

  1. The Private Key (or the matching CSR already generated on that specific node).
  2. The Sectigo Device Certificate matching that specific node’s Fully Qualified Domain Name (FQDN).
  3. The Sectigo Intermediate/Chain bundle. [1, 2]

Step 1: Import the Sectigo Chain Certificate

You must import the Sectigo intermediate certificates first so the system can build a trusted path. Repeat this on both Node A and Node B. [1, 2]

  1. Log into the BIG-IP Web GUI. [1]
  2. Navigate to System > Certificate Management > Traffic Certificate Management > SSL Certificate List. [1]
  3. Click Import. [1]
  4. For Import Type, select Certificate. [1]
  5. In Certificate Name, type Sectigo_Chain. [1]
  6. In Certificate Source, choose Upload File and browse to your Sectigo chain bundle file. [1]
  7. Click Import. [1]

Step 2: Install the Node-Specific Device Certificate

Since you have two uniquely named nodes, you must perform this step using the node-specific certificate file on its respective device. [1]

  1. On Node A, navigate to System > Certificate Management > Device Certificate Management > Device Certificate.
  2. Click the Import tab (or Renew/Replace depending on whether you are replacing an existing third-party or self-signed cert).
  3. For Import Type, select Certificate and Key (if uploading both together) or Certificate (if you generated the CSR directly on this BIG-IP node).
  4. Under Certificate Source, browse and choose the issued Sectigo .crt file for Node A.
  5. Under Key Source, upload the matching private key (skip if the key is already present from a local CSR).
  6. Click Import.
  7. Repeat this exact procedure on Node B using Node B’s unique Sectigo certificate and key. [1, 2, 3, 4, 5]

Step 3: Append the Intermediate Chain (CLI Workaround)

F5’s Web GUI management daemon (httpd) consumes the device certificate file directly from /config/httpd/conf/ssl.crt/server.crt. Often, uploading a device certificate via the GUI does not automatically append the intermediate chain, causing SSL handshake errors in browsers.

To fix this, execute this step via the CLI on both nodes:

  1. SSH into the BIG-IP bash terminal.

  2. Run the following command to append your imported Sectigo chain to the active Web GUI certificate:

    bash

    cat /config/filestore/files_d/Common_d/certificate_d/:Common:Sectigo_Chain_* >> /config/httpd/conf/ssl.crt/server.crt

    Use code with caution.

    (Note: Adjust the file path name if your imported chain object varies, you can tab-complete the name inside /config/filestore/files_d/Common_d/certificate_d/).

Step 4: Restart the HTTPD Service

For the new Sectigo certificates to take effect on the admin portals, restart the web services on each node: [1]

  1. In the SSH terminal of both devices, run:

    bash

    bigstart restart http

    Anyhow after running through the process my portal rebooted and came back up but the public certificate was not applied. I tried from an incognito window and it still did not work with the public certificate name.

    Then I tried a different set of instructions but it was not for an HA pair so now I messed up that node because the Admin portal is not coming back up at all. This was my fault as I forgot to include the fact that it was an HA pair in my search.

    The VIPs are all running on the Active node and I have access to both consoles via Putty. I just lost access to the Admin console for the Active node only.

    If anyone has any ideas of what I can try, I’d appreciate it.

2

Danny_Arroyo,

Do you need to install a certificate authority (CA) signed certificate for management access to the BIG-IP device?

There is two main locations to install a SSL /TLS certificates on a BIG-IP device. One is the certificate store that is used content / load balancing configuration. The second is the device certificate. The device certificate is used for access to the administrative interface / management web interface..

The process that Goggle provided appears to be a mix of the two locations.

Here is a KB article for updating the device certificate.

K16951115: Changing the BIG-IP system device certificate using the Configuration utility

The “Replace the device certificate” process can be used to install the signed CA certificate for the device certificate.

The “Update the device certificate intermediate CA if applicable” process can be used to install CA chain.

I personal do no like the KB because its confusing. Updating the certificates for BIG-IP DNS, formally Global Traffic Manager (GTM), should be in a separate KB.

Here is a manual chapter that includes a process to import a device certificate.

. Device Certificate Management

3

Thank you for the F5 KB, however we have an HA pair of F5’s. The KB walkthrough seems to be for a standalone unit. Do you know of any KBs for an HA pair?

4

Can you confirm if this cert installation is for traffic management or device management? HA for traffic is one installation and a sync, installation for device is separate installations on each unit.

5

Hi JRahm,

We are enabling Sectigo Certificate automation (ACME) and most of our certificates live on the F5. One of the requirements of this process is that both of our F5s have a public certificate. From what I understand the ACME Agent needs to communicate securely to either of the F5 nodes in order to renew certificates and place them in the proper F5 configs.

That said my guess is that I need this for device management.

Hope my description of what we are doing helps answer your question.

Thank you

6

Most third party management applications use iControl API to access the BIG-IP. IControl uses the device certificate.

7

For manual process, you’d log in to the BIG-IP, and navigate to:

csr1
csr1564×355 26.3 KB

Then click Create (or renew if already done previously). Then fill out the details and click finish, which should result in this view:

csr2
csr2687×505 61.7 KB

Copy that text, or download the server.csr file. At this point, you’ll submit that in your Sectigo CA tools. Once they issue your cert and chain, come back to the BIG-IP and import here:

certchain
certchain571×355 31 KB

and here:

cert
cert575×357 32.7 KB

That should put you in good shape. Repeat for your other devices.