Hello - i have installed Bigip version 21.1 and want to configure ACME to automate Certificate renewal from Digicert and our internal CA.
has any one configured it yet ? and are there any documents that guide on how to configure … maybe a video
thanks
thanks for the reply - but none of these help with setting up Acme agent that is now on F5 - the video and document are for digicert sensor implementation
A little late to the conversation, but please also review the following article:
Automatic Certificate Management with ACMEv2 in F5 BIG-IP | DevCentral
I will also provide some additional guidance inline below.
Step 1: Create an HTTP virtual server:
The ACMEv2 HTTP-01 validation requires that the ACME be able to challenge an HTTP:80 listener on the IP address resolved from public DNS. Your BIG-IP needs an HTTP:80 VIP that will listen for this challenge request and respond with a token provided by the ACME server at the beginning of the transaction. For BIG-IP ACMEv2 support you simply need an LTM VIP listening on port 80, with an HTTP profile attached, and the “ACMEv2 Challenge” option enabled.
Navigate to Local Traffic --> Virtual Servers
tmsh create ltm virtual www.f5labs.local \
destination 10.1.10.120:80 \
profiles replace-all-with { tcp http } \
acmev2-challenge enabled \
vlans replace-all-with { client-vlan } \
vlans-enabled
This will handle requests to /.well-known/acme-challenge. If the HTTP:80 VIP is also used to auto-redirect to the HTTPS site, you’ll need to modify the redirect iRule to ignore this URL.
when HTTP_REQUEST {
if { !([HTTP::uri] starts_with "/.well-known/acme-challenge") } {
HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
}
}
---------------------------
Step 2: Create a DNS resolver
The resolver is used here to provide a resolution path for the ACME client to find the ACME service(s) and is attached to an internal proxy object.
Navigate to Network --> DNS Resolvers
tmsh create net dns-resolver acme-resolver \
{ forward-zones replace-all-with \
{ . { nameservers replace-all-with { 10.1.10.53:53 }}}}
---------------------------
Step 3: Add an ACME CA bundle
The CA bundle is needed to validate the TLS communications with the ACME service. For an Internet ACME service, like Lets Encrypt, it may be sufficient to use the built-in “ca-bundle” or “blended-bundle”.
Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List
---------------------------
Step 4: Create the ACME account key
The ACME account key is used to create an account registration with the ACME service. This is typically just a self-signed certificate. For ACME services that require EAB you’d still create this key, but EAB would be used for “pre-authentication”.
Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List
tmsh create sys crypto key acme-account-key
tmsh create sys crypto cert acme-account-key \
key acme-account-key \
common-name acme-account-key \
subject-alternative-name DNS:acme-account-key
---------------------------
Step 5: Create the internal proxy object
The internal proxy provides the routing path to the ACME service on the BIG-IP data plane, and supports both routed and explicit proxy connectivity.
Navigate to System --> Services --> Internal Proxies
tmsh create sys internal-proxy acme-proxy { dns-resolver acme-resolver route-domain 0 }
---------------------------
Step 6: Create an ACME provider
An ACME provider defines how to connect to a specific ACME service (ex. Lets Encrypt), and includes the directory URL path and any authentication requirements.
Navigate to System --> Certificate Management --> Traffic Certificate Management --> ACME Provider List
tmsh create sys crypto acme-provider acme-provider-letsencrypt \
internal-proxy acme-proxy \
trusted-ca-cert acme-bundle \
directory-url https://acme-staging-v02.api.letsencrypt.org/directory \
account-key acme-account-key \
challenge-type { http-01 } \
accepted-tos true \
account-action activate
---------------------------
Step 7: Generate a certificate from CSR
You can now generate an ACME request directly from a key and CSR.
Navigate to System --> Certificate Management --> Traffic Certificate Management --> SSL Certificate List
tmsh create sys crypto \
key www.f5labs.local \
gen-csr www.f5labs.local \
common-name www.f5labs.local \
subject-alternative-name DNS:www.f5labs.local \
organization f5labs.local \
city omaha \
state ne \
country us \
key-type rsa-private \
key-size 2048 \
key-usage "keyAgreement,digitalSignature,keyEncipherment" \
acme-provider add { acme-provider-letsencrypt { order-type new identifiers none } }
You can also spawn an ACME renewal directly from an existing cert/key. Open/edit a cert/key object, go to the key tab, select an ACME provider, and set ACME order Type to ‘New’ or ‘Renew’ and then click the Update button. Periodically click the Refresh button to check the status.
Thanks.