Automatic Certificate Management with ACMEv2 in F5 BIG-IP
One of the most anticipated features of F5 BIG-IP is integration with ACMEv2. With the General Availability of BIG-IP 21.1.0 on May/26, this feature came into being. In this tutorial, we are going to configure it, using Let's Encrypt as the CA. The domain for which we are generating/renewing certificates is carlosf5lab.lat. The official docs for this feature are located in SSL Certificate Management | BIG-IP Documentation. Pre-requisite 1: DNS Resolver that can reach the internet (at least the CA endpoints). In this case, we are using the native DNS Resolver that comes with BIG-IP. Pre-requisite 2: The internal proxy that will make the connection with the CA. Pre-requisite 3: a self signed SSL certificate that the ACMEv2 protocol uses as the identifier for a device account. You don't have to fill the Subject Alternative Name. For the Common Name, an e-mail contact is advised. Now, we are going to create the ACME Provider object. Give it a name, and select the internal proxy previously created. For the CA Certificate to enable the secure connection with the Directory URL, you can use the default ca-bundle.crt. The Directory URL is the endpoint for the ACMEv2 protocol. In Let's Encrypt case, it is https://acme-v02.api.letsencrypt.org/directory For the Account Key, choose the previously created self-signed certificate. For the trickier part of all, the field "Contacts" is mandatory, and it must be an URL. That’s why you must use the format mailto:email_address. Check the Terms and Conditions, and the Create Account boxes. After a while, the Account Status must read as "Valid". To prove you own the domain whose certificate Let's Encrypt is going to create/renew, it must be pointing to an IP (A Record) where you must have your Virtual Server listening on Port 80 configured to respond to the ACMEv2 Challenge. (In this specific lab, the domain carlosf5lab.lat points to a Public IP mapped to an internal IP). Now you can order your first certificate via ACMEv2 on BIG-IP: After a while, the Key tab should read something like: Which means your certificate was generated: To track the ACME Provider, you can check its statistics: That's it, my friend! If it helped you, give a thumbs up to this post!API Discovery and Enforcement with API Security Local Edition
API Security Local Edition is a self-hosted platform that discovers APIs from BIG-IP traffic insights, builds and maintains an inventory with risk scoring, and pushes enforcement back to BIG-IP. This article covers the architecture, the data flows between components, and the operator workflow from discovery to enforcement.
F5 Insight for ADSP - A Closer Look
Introduction F5 Insight for ADSP, a key component of the F5 Application Delivery and Security Platform (ADSP), helps teams monitor and secure apps that are spread across hybrid, multi-cloud and AI environments. In this article, I’ll highlight some of the key features and use cases addressed by F5 Insight. Demo Video Demo Video: F5 Insight for ADSP - A Closer Look The F5 Insight Home Screen The F5 Insight Home Screen provides comprehensive monitoring for your F5 infrastructure, applications, and security posture. It features intelligent anomaly detection and performance optimization tools, giving administrators and users a centralized view of their BIG-IP fleet health and operational status. System Report Cards The System Report Cards display health indicators ranked Good, Warning, and Critical for the following: Anomaly Detection Monitors the connection count, pool availability, CPU utilization, and memory usage. Application Performance Monitors application-level health based on response time, 4xx, and 5xx error codes. Security Monitors the expiration of SSL/TLS certificates and BIG-IP WAF events. BIG-IP Metrics Monitors for BIG-IP health issues with device resources and operational status. Fleet Status Displays a summary of all BIG-IP devices and their operational status. The Fleet Status shows all the BIG-IP devices with a status of Up, Down or Degraded. Ask AI Assistant Allows you to type queries in plain English to retrieve device statistics, configuration information, security events, device health, application performance and much more. The AI Assistant connects to a configurable Large Language Model (LLM) backend. Supported providers include OpenAI, Anthropic, or a customer provided LLM. An example query: Have there been any outages in the past 24 hours for all devices in all data centers? The AI Assistant understands the question and has identified all the data centers. The AI Assistant then checks the device statistics for any outages or issues. The AI Assistant compiles a detailed summary report of the query. Configuration of Large Language Model (LLM) Large language model (LLM) Insights bring natural language intelligence to F5 Insight, enabling you to query your BIG-IP configurations and logs conversationally. Instead of manually searching through configurations or parsing log files, you can ask questions like “Why is pool member X marked down?” or “Show me all virtual IPs (VIPs) with SSL offloading enabled” and receive immediate, contextualized, clear answers. In the toolbar on the left under Manage, select LLM Insights. Select your LLM Provider Enter your API Token/Key Enter your Enterprise API URL Click Test Connection to verify it’s working Click Save Configuration when the connection is validated. Conclusion F5 Insight for ADSP offers customizable visualizations and dashboards to help you surface metrics and KPIs tailored to your organization. It provides access to useful telemetry data for a deeper understanding of your environment, application behaviors, and complex BIG-IP deployments, all centralized in a single location. Identification of root causes during outages/tickets. Solves issues and struggles with Day 2 analysis of your BIG-IP Fleet and the applications therein. Mitigates the problem of a lack of detailed visual information on your BIG-IP Fleet. Set a foundation for the utilization of open-source tools and their benefits. Related Content Introducing F5 Insight for ADSP F5 Insight for ADSP Documentation F5 Insight Product Page
What’s New in BIG-IQ v8.4.1?
Introduction F5 BIG-IQ Centralized Management, a key component of the F5 Application Delivery and Security Platform (ADSP), helps teams maintain order and streamline administration of BIG-IP app delivery and security services. In this article, I’ll highlight some of the key features, enhancements, and use cases introduced in the BIG-IQ v8.4.1 release and cover the value of these updates. Effective management of this complex application landscape requires a single point of control that combines visibility, simplified management and automation tools. Demo Video New Features in BIG-IQ 8.4.1 Support for F5 BIG-IP v17.5.1.X and BIG-IP v21.0 BIG-IQ 8.4.1 provides full support for the latest versions of BIG-IP (BIG-IP 17.5.1.X and 21.0) ensuring seamless discovery and compatibility across all modules. Users who upgrade to BIG-IP 17.5.1.X+ or 21.0 retain the same functionality without disruptions, maintaining consistency in their management operations. As you look to upgrade BIG-IP instances to the latest versions, our recommendation is to use BIG-IQ. By leveraging the BIG-IQ device/software upgrade workflows, teams get a repeatable, standardized, and auditable process for upgrades in a single location. In addition to upgrades, BIG-IQ also enables teams to handle backups, licensing, and device certificate workflows in the same tool—creating a one-stop shop for BIG-IP device management. Note that BIG-IQ works with BIG-IP appliances and Virtual Editions (VEs). Updated TMOS Layer In the 8.4.1 release, BIG-IQ's underlying TMOS version has been upgraded to v17.5.1.2, which will enhance the control plane performance, improve security efficacy, and enable better resilience of the BIG-IQ solution. MCP Support BIG-IP v21.0 introduced MCP Profile support—enabling teams to support AI/LLM workloads with BIG-IP to drive better performance and security. Additionally, v21.0 also introduces support for S3-optimized profiles, enhancing the performance of data delivery for AI workloads. BIG-IQ 8.4.1 and its interoperability with v21.0 helps teams streamline and scale management of these BIG-IP instances—enabling them to support AI adoption plans and ensure fast and secure data delivery. Enhanced BIG-IP and F5OS Visibility and Management BIG-IQ 8.4.1 introduces the ability to provision, license, configure, deploy, and manage the latest BIG-IP devices and app services (v17.5.1.X and v21.0). In 8.4, BIG-IQ introduced new visibility fields—including model, serial numbers, count, slot tenancy, and SW version—to help teams effectively plan device strategy from a single source of truth. These enhancements also improved license visibility and management workflows, including exportable reports. BIG-IQ 8.4.1 continues to offer this enhanced visibility and management experience for the latest BIG-IP versions. Better Security Administration BIG-IQ 8.4.1 includes general support for SSL Orchestrator 13.0 to help teams manage encrypted traffic and potential threats. BIG-IQ includes dedicated dashboards and management workflows for SSL Orchestrator. In BIG-IQ 8.4, F5 introduced support and management for Venafi Trust Protection Platform v22.x-24.x, a leading platform for certificate management and certificate authority services. This integration enables teams to automate and centrally manage BIG-IP SSL device certificates and keys. BIG-IQ 8.4.1 continues this support. Finally, BIG-IQ 8.4.1 continues to align with AWS security protocols so customers can confidently partner with F5. In BIG-IQ 8.4, F5 introduced support for IMDSv2, which uses session-oriented authentication to access EC2 instance metadata, as opposed to the request/response method of IMDSv1. This session/token-based method is more secure as it reduces the likelihood of attackers successfully using application vulnerabilities to access instance metadata. Enhanced Automation Integration & Protocol Support BIG-IQ 8.4.1 continues with BIG-IQ's support for the latest version of AS3 and templates (v3.55+). By supporting the latest Automation Toolchain (AS3/DO) BIG-IQ is aligned with current BIG‑IP APIs and schemas, enabling reliable, repeatable app and device provisioning. It reduces deployment failures from version mismatches, improves security via updated components, and speeds operations through standardized, CI/CD-friendly automation at scale. BIG-IQ 8.4 (and 8.4.1) provides support for IPv6. IPv6 provides vastly more IP addresses, simpler routing, and end‑to‑end connectivity as IPv4 runs out. BIG‑IQ’s IPv6 profile support centralizes configuration, visibility, and policy management for IPv6 traffic across BIG‑IP devices—reducing errors and operational overhead while enabling consistent, secure IPv6 adoption. Upgrading to v8.4.1 You can upgrade from BIG-IQ 8.X to BIG-IQ 8.4.1. BIG-IQ Centralized Management Compatibility Matrix Refer to Knowledge Article K34133507 BIG-IQ Virtual Edition Supported Platforms BIG-IQ Virtual Edition Supported Platforms provides a matrix describing the compatibility between the BIG-IQ VE versions and the supported hypervisors and platforms. Conclusion Effective management—orchestration, visibility, and compliance—relies on consistent app services and security policies across on-premises and cloud deployments. Easily control all your BIG-IP devices and services with a single, unified management platform, F5® BIG-IQ®. F5® BIG-IQ® Centralized Management reduces complexity and administrative burden by providing a single platform to create, configure, provision, deploy, upgrade, and manage F5® BIG-IP® security and application delivery services. Related Content Boosting BIG-IP AFM Efficiency with BIG-IQ: Technical Use Cases and Integration Guide Five Key Benefits of Centralized Management F5 BIG-IQ What's New in v8.4.0?
What’s new in F5 Insight for ADSP v1.2.2?
Introduction We’re pleased to announce the release of F5 Insight for ADSP v1.2.2. This release focuses on expanding software lifecycle management capabilities, bolstering installation durability, and giving administrators real-time control across complex environments. F5 Insight for ADSP, a key component of the F5 Application Delivery and Security Platform (ADSP), helps teams monitor and secure apps that are spread across hybrid, multi-cloud and AI environments. We’re pleased to announce the release of F5 Insight for ADSP v1.2.2. This release focuses on expanding software lifecycle management capabilities, bolstering installation durability, and giving administrators real-time control across complex environments. Key highlights include added support for TMOS Engineering Hotfixes, added support for F5OS-A / F5OS 2.0 update and patching workflows, and expanded Standalone/Bulk installation flexibility. Key Highlights Support for BIG-IP (TMOS) Engineering Hotfixes F5 Insight v1.2.2 now supports updating BIG-IP software to Engineering Hotfix versions. You can distribute and install Engineering Hotfix software to your BIG-IP directly from within F5 Insight. Readiness checks, distribution logic, and installation support for TMOS Engineering Hotfixes are now supported. This enables seamless deployment of specialized patches directly through F5 Insight. Support for F5OS-A / F5OS 2.0 F5 Insight v1.2.2 now supports the installation of F5OS-A / F5OS 2.0 software patches and updates. (Major and Minor version upgrades are not yet supported). You can patch/update F5OS-A / F5OS 2.0 directly from within F5 Insight. F5OS-specific readiness checks are performed before and after installation to ensure a smooth update experience. The following are checked prior to and after an upgrade: cluster firmware_status fpga_status cores tenant_status service_pods. Warnings and blocking events will be displayed directly within the Insight UI. The setup progress will display the status of the update with messages like the following: "Upgrading Firmware..." Expanded "Standalone / Bulk" Software Installations F5 Insight version 1.2.2 updates the "Standalone" job type to a "Standalone / Bulk" type. These jobs can now be executed across target devices regardless of HA state (Active, Standby, or Standalone), surfacing helpful warnings when HA pair instances are selected while still allowing manual operator management. At the end of the day, this allows administrators the flexibility to: upgrade 20 Standby devices in one job, then manage failover independently, and then have another job to upgrade the now-Standby 20 devices. This wasn’t possible in v1.2.1 and prior. Picking the Standalone/Bulk Job Type: Warning & Tooltip when Active or Standby instances are in the ‘Standalone/Bulk’ job type: Warning that must be acknowledged before the user can click the ‘Execute Job’ button: Real-Time Instance Metadata Refresh Adds a "Refresh" button on the instance table in the Software Installation job drawer. Admins can refresh real-time metadata (Instance Name, Active Volume, Target Volume, and HA state) before running patches or installations, ensuring that the instance details are current. FQDN Support for LDAP and SAML Identity Providers F5 Insight uses an external URL for LDAP and SAML authentication. By default, it uses the appliance IP address in these redirect URLs. If users access F5 Insight through a fully qualified domain name (FQDN), you should configure that FQDN as the external URL so that login redirects and callback URLs match the address in the browser. In F5 Insight v1.2.2, you can configure the external FQDN through the UI or the REST API. The CLI script f5insight-set-fqdn is also available as a fallback option. Using an FQDN is recommended for: TLS certificate hostname validation. Better user experience (friendly login URLs). Stable identity across IP changes. Custom CA Certificates for LDAP/LDAPS Authentication F5 Insight v1.2.2 supports custom Certificate Authority (CA) certificates to secure LDAP authentication. As an administrator, you can: Upload a CA certificate or CA bundle to the Trust Store. Select the uploaded CA when you configure an LDAP identity provider. Validate the LDAP server certificate for LDAPS connections using the selected CA. Conclusion F5 Insight for ADSP v1.2.2 accelerates threat remediation workflows and minimizes upgrade risks across BIG-IP and F5OS environments. By combining automated pre-and post-installation readiness checks with targeted TMOS hotfix support, real-time volume metadata verification, and flexible bulk execution, operations teams can confidently deploy updates, eliminate configuration drift, and maintain uptime during critical maintenance windows. Upgrade today to the latest version of F5 Insight for ADSP and enjoy the following benefits: Support for TMOS Engineering Hotfixes Support for F5OS-A / F5OS 2.0 with specific pre/post readiness checks Expanded Standalone/Bulk software installation flexibility FQDN Support for LDAP and SAML Identity Providers Custom CA Certificates for LDAP/LDAPS Authentication Related Content F5 Insight v1.2.2 Release Notes and Security Updates F5 Insight Documentation F5 Insight for ADSP – Initial Setup in VMware F5 Insight for ADSP - A Closer Look F5 Insight Product PageWhat’s new in F5 Insight for ADSP v1.2?
Introduction F5 Insight for ADSP, a key component of the F5 Application Delivery and Security Platform (ADSP), helps teams monitor and secure apps that are spread across hybrid, multi-cloud and AI environments. In this article, I’ll highlight some of the new features introduced in F5 Insight v1.2. Demo Video Fleet Management F5 Insight v1.2 supports software patching of your BIG-IP instances. From the web UI navigate to Manage > Software > Images. Click Upload to add a BIG-IP software image. Click Upload File Select the software image you want to update to, 17.5.1.6 in this example NOTE: The sig and pem files are not required to upgrade but are recommended so F5 Insight can verify the software image. The files will be uploaded automatically and will look like this when done. Click the X to close the dialog box. The Software page should now look like this. NOTE: Additional details about the Product, Version and Status are available here Next go to Manage > Automation > Jobs > Add Job > Software Distribution Fill in the Job Name and add a Description if desired Select the BIG-IP Instance(s) you wish to distribute to, then click Back to Job Settings Click Add Software Select the version you wish to distribute then Apply Click Check Instances if needed Set the Distribution Type to Serial or Parallel Click Execute Job Confirm the Job Execution by entering a Change Request then click Execute Job The Job is now running Click the number under Executions to view the progress. When the software image has been distributed to the BIG-IP Instances it will look like the following: Click Add Job > Software Installation to create an Install job Under General Settings give the job a Name, add a Description if desired Under Installation Type select HA Pair or Standalone, Standalone in this example Set the Execution Type to Serial or Parallel, Serial in this example Select the Software Target Version Select the Instance to install the software Click Back to Job Settings Set the Target Volume option as needed, Next Sequential in this example Choose the Target Volume, HD1.2 in this example Under Readiness Checks click Run Check A successful Readiness Check should look like the following: Click Execute Job Enter the Change Request, type BEGIN INSTALLATION then click Execute Job You can see that the Job is Running Click the number under Executions to view the progress The BIG-IP will be rebooted automatically and the Jobs screen will look like the following when done: Administrator Authentication – RBAC, LDAP & SAML F5 Insight v1.2 now supports external authentication, enabling enterprise customers to integrate with their existing identity infrastructure for centralized user management and secure access control. External authentication is supported via LDAP and SAML providers like Ping and Okta. Support for Role Based Access Control (RBAC) allows customers to choose from 3 predefined roles: Admin gives full system access including user management, device configuration, and all settings. Operator gives device configuration and troubleshooting. Viewer gives read-only access for monitoring and observation Configuring an LDAP Provider From the F5 Insight UI navigate to System Management > User Administration > SSO/Identity Providers. Under Add provider click LDAP Give it a name, “LDAP” in this example. Specify the LDAP URL, Base DN, Bind DN and Bind Password. NOTE: Click the plus sign next to the red arrow to add additional LDAP URLs Specify the User binding settings and LDAP attributes. You can also enable Start TLS for the connection to the LDAP server. Click Create when done. Role Mapping determines which F5 Insight role an external user receives upon login. Roles are assigned based on group attributes configured on the LDAP or SAML identity provider. Navigate to System Management > User Administration > Roles > Role Mapping. Select the Provider, either LDAP or SAML. Specify the Grouped Resource Attribute to map to. Click Save. You have successfully mapped the LDAP Grouped Resource Attribute to the Admin Role. Configuring a SAML Provider From the F5 Insight UI navigate to System Management > User Administration > SSO/Identity Providers. Click SAML under Add provider. To add a SAML Provider give it a name. Specify the Metadata XML, URL and Binding. Click Create when done. NOTE: The Role Mapping procedure is the same for SAML Refer to the F5 Insight Documentation for more details on configuring RBAC, LDAP and SAML. Audit Logging F5 Insight v1.2 added support for AI Assistant Chat Logging as well as Audit Logging of AI Events. The AI Assistant Chat History saves your interactions with the AI Assistant The AI Audit Console provides an audit log of all the different AI Assistant Event Types. It contains many options for filtering Events as well as the option to Mask Sensitive Data. When Sensitive Data Masking is turned off you can see the Source IP and User Agent F5 Insight Backup / Restore F5 Insight v1.2 added support for backing up & restoring an F5 Insight configuration. From the web UI navigate to System Management > Backup & Restore > Backup > Create Backup Select the Backup Type > Storage Target. Enter the Encryption Passphrase and optionally specify a Backup Name. Click Submit Creation It should look like the following when complete: NOTE: You can download a copy of the backup file by clicking the icon on the right Click the Restore icon on the right to Restore the Config Backup Select the options you want restored and enter the Decryption Passphrase. Click Start Restore When the Restore process is complete it will look like the following: Click Create Scheduled Backup to configure a recurring Backup Schedule Configure the Schedule Name, Frequency, Day of Week, Time, Backup Type, Storage Location, and Encryption Passphrase. Click Submit Creation when done When complete It should look like the following: To configure Backup Settings navigate to Backup & Restore > Settings To add external storage click Add Storage Location Specify the Location Name, Storage Type (NFS or SMB), Host / Server, and Path. Click Save Location when done Conclusion The latest version of F5 Insight for ADSP offers expanded functionality with F5 Fleet Management. It also provides powerful management features like RBAC, LDAP and SAML authentication, Audit Logging capabilities, and F5 Insight Backup / Restore options. Upgrade today to the latest version of F5 Insight for ADSP and enjoy the following benefits: Manage BIG-IP software upgrade RBAC, LDAP & SAML authentication Audit Logging Configuration Backup & Restore Related Content Introducing F5 Insight for ADSP F5 Insight for ADSP – Initial Setup in VMware F5 Insight for ADSP - A Closer Look F5 Insight for ADSP Documentation F5 Insight Product Page
Certificate Automation for BIG-IP using CyberArk Certificate Manager, Self-Hosted
The issue of reduced lifetimes of TLS certificates is top of mind today. This topic touches upon reducing the risks associated with human day-to-day management tasks for such critical components of secure enterprise communications. Allowing a TLS certificate to expire, by simple operator error often, can preclude the bulk of human or automated transactions from ever completing. In the context of e-commerce, as only one single example, such an outage could be financially devastating. Questions abound: why are certificate lifetimes being lowered; how imminent is this change; will it affect all certificates? An industry association composed of interested parties, including many certificate authority (CA) operators, is the CA/Browser Forum. In a 29-0 vote in 2025, it was agreed public TLS certificates should rapidly evolve from the current 398 day de-facto lifetime standard to a phased arrival at a 47 day limit by March 2029. An ancillary requirement, demonstrating the domain is properly owned, known as Domain Control Validation (DCV) will drop to ten days. Although the governance of certificate lifecycles overtly pertains to public certificates, the reality is enterprise-managed, so called private CAs, likely need to fall in lock step with these requirements. Pervasive client-side software elements, such as Google Chrome, are used transparently by users with certificates that may be public or enterprise issued, and having a single set of criteria for accepting or rejecting a certificate is reasonable. Why Automated Certificate Management on BIG-IP, Now More than Ever? A principal driver for shortening certificate (cert) lifetimes; the first phase will reduce public certs to 200-day durations this coming March 15, 2026, is simply to lessen the exposure window should the cert be compromised and mis-used by an adversary. Certificates, and their corresponding private keys, can be manually maintained using human-touch. The BIG-IP TMUI interface has a click-ops path for tying certificates and keys to SSL profiles, for virtual servers that project HTTPS web sites and services to consumers. However, this requires something valuable, head count, and diligence to ensure a certificate is refreshed, perhaps through an enterprise CA solution like Microsoft Certificate Authority. It is critical this is done, always and without fail, well in advance of expiry. An automated solution that can take a “set it and forget it” approach to maintain both initial certificate deployment and the critical task of timely renewals is now more beneficial than ever. Lab Testing to Validate BIG-IP with CyberArk Trusted Protection Platform (TPP) A test bed was created that involved, at first, a BIG-IP in front of an HTTP/HTTPS server fleet, a Windows 2019 domain controller and a Windows 10 client to test BIG-IP virtual servers with. Microsoft Certificate Authority was installed on the server to allow for the issuance of enterprise certs for any of the HTTPS virtual servers created on the BIG-IP. Here is the lab layout, where virtual machines were leveraged to create the elements, including BIG-IP virtual edition (VE). The lab is straight forward; upon the Windows 2019 domain controller the Microsoft Certificate Authority component was installed. Microsoft SQL server 2019 was also installed, along with SQL Management Studio. In an enterprise production environment, these components would likely never share the domain controller host platform but are fine for this lab setup. Without an offering to shield the complexity and various manual processes of key and cert management, an operator will need to be well-versed with an enterprise CA solution like Microsoft’s. A typical launching sequence from Server Manager is shown below, with the sample lab CA and a representative list of issued certificates with various end dates. Unequipped with a solution like that from CyberArk, a typical workflow might be to install the web interface, in addition to the Microsoft CA and generate web server certificates for each virtual server (also frequently called “each application”) configured on the BIG-IP. A frequent approach is to create a unique web server template in Microsoft CA, with all certificates generated manually following the fixed, user specified certificate lifetime. As seen below, we are not installing anything but the core server role of Certificate Authority, the web interface for requesting certificates is not required and is not installed as a role. CyberArk Certificate Manager, Self-Hosted – Three High-Value Use Cases The self-hosted certificate and key management solution from CyberArk is a mature, tested offering having gained a significant user base and still may be known by previous names such as Venafi TLS Protect, or Venafi Trust Protection Platform (TPP). CyberArk acquired Venafi in 2024. Three objectives were sought in the course of the succinct proof-of-concept lab exercise that represented expected use cases: 1. Discover all existing BIG-IP virtual server TLS certificates 2. Renew certificates and change self-signed instances to enterprise PKI-issued certificates 3. Create completely new certificates and private keys and assign to BIG-IP new virtual servers The following diagram reflects the addition of CyberArk Certificate Manager, or Venafi TPP if you have long-term experience with the solution, to the Windows Server 2019 instance. Use Case One – Discover all BIG-IP Existing Certificates Already Deployed In our lab solution, to re-iterate the pivotal role of CyberArk Certificate Manager (Venafi TPP) in certificate issuance, we have created a “PolicyTree” policy called “TestingCertificates”. This will be where we will discover all of our BIG-IP virtual servers and their corresponding SSL Client and SSL server profiles. An SSL Client profile, for example, dictates how TLS will behave when a client first attempts a secure connection, including the certificate, potentially a certificate chain if signage was performed with an intermediate CA, and protocol specific features like support for TLS 1.3 and PQC NIST FIPS 203 support. Here are the original contents of the TestingCertificates folder, before running an updated discovery, notice how both F5 virtual servers (VS) are listed and the certificates used by a given VS. This is an example of the traditional CyberArk GUI look and feel. A simple workflow exists within the CyberArk platform to visually set up a virtual server and certificate discovery job, it can be run manually once, when needed, or set to operate on a regular schedule. This screenshot shows the fields required for the discovery job, and also provides an example of the evolved, streamlined approach to the user interface, referred to as the newer “Aperture” style view. Besides the enormous time savings of the first-time discovery of BIG-IP virtual servers, and certificates and keys they use in the form of SSL profiles, we can also look for new applications stood up on the BIG-IP through on-going CyberArk discovery runs. In the above example, we see a new web service implemented at the FQDN of www.twotitans.com has just been discovered. Clicking the certificate, one thing to note is the certificate is self-signed. In real enterprise environments, there may be a need to re-issue such a certificate with the enterprise CA, as part of a solid security posture. Another, even more impactful use case is when all enterprise certificates need to be easily and quickly switched from a legacy CA to a new CA the enterprise wants to move to quickly and painlessly. We see with one click on a certificate discovered that some key information is imparted. On this one screen, an operator might note that this particular certificate may warrant some improvements. It is seen that only 2048 bits are used in the certificate; the key is not making use of advanced storage and on, such as a NetHSM, and the certificate itself has not been built to support revocation mechanisms such as Content Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP). Use Case Two - Renew Certificates and Change Self-signed Instance to Enterprise PKI-Issued Certificates The automated approach of a solution like CyberArk’s likely means manual interactive certificate renewal is not going to be prevalent. However, for the purpose of our demonstration, we can examine a current certificate, alive and active on a BIG-IP supporting the application, s3.example.com. This is the “before” situation (double-click image for higher resolution). The result upon clicking the “Renew Now” button is a new policy-specific updated 12-month lifetime will be applied to a newly minted certificate. As seen in the following diagram, the certificate and its corresponding private key are automatically installed on the SSL Client Profile on the BIG-IP that houses the certificate. The s3.example.com application seamlessly continues to operate, albeit with a refreshed certificate. A tactical usage of this automatic certificate renewal and touchless installation is grabbing any virtual servers running with self-signed certificates and updating these certificates to be signed by the enterprise PKI CA or intermediate CA. Another toolkit feature now available is to switch out the entire enterprise PKI from one CA to another CA, quickly. In our lab setup, we have a Microsoft CA configured; it is named “vlab-SERVERDC1-ca”. The following certificate, ingested through discovery by CyberArk from the BIG-IP, is self-signed. Such certificates can be created directly within the BIG-IP TMUI GUI, although frequently they are quickly generated with the OpenSSL utility. Being self-signed, traffic through into this virtual will typically cause browser security risk pop-ups. They may be clicked through by users in many cases, or the certificate may even be downloaded from the browser and installed in the client’s certificate store to get around a perceived annoyance. This, however, can be troublesome in more locked-down enterprise environments where an Active Directory group policy object (GPO) can be pushed to domain clients, precluding any self-signed certificates being resolved with a few clicks around a pop-up. It is more secure and more robust to have authorized web services, vetted, and then incorporated into the enterprise PKI environment. This is the net result of using CyberArk Certificate Manager, coupled with something like the Microsoft enterprise CA, to re-issue the certificate (double-click). Use Case Three - Create Completely New Certificates and Private Keys and Assign to BIG-IP New Virtual Servers Through the CyberArk GUI, the workflows to create new certificates are intuitive. Per the following image, right-click on a policy and follow the “+Add” menu. We will add a server certificate and store it on the BIG-IP certificate and key list for future usage. A basic set of steps that were followed: Through the BIG-IP GUI, setup the application on the BIG-IP as per a normal configuration, including the origin pool, the client SSL profile, and a virtual server on port 443 that ties these elements together. Create, on CyberArk, the server certificate with the details congruent with the virtual server, such as common name, subject alternate name list, key length desired. On CyberArk, create a virtual server entry that binds the certificate just created to the values defined on the BIG-IP. The last step will look like this. Once the certificate is selected for “Renewal” the necessary elements will automatically be downloaded to the BIG-IP. As seen, the client’s SSL profile has now been updated with the new certificate and key signed by the enterprise CA. Summary This article demonstrated an approach to TLS certificate and key management for applications of all types, which harnesses the F5 BIG-IP for both secure and scalable delivery. With the rise in the number of applications that require TLS security, including advanced features enabled by BIG-IP, like TLS1.3 and PQC, coupled with the industry’s movement towards very short certificate lifecycle, the automation discussed will become indispensable to many organizations. The ability to both discover existing applications, switch out entire enterprise PKI offerings smoothly, and to agilely create new BIG-IP centered applications was touched upon.How I did it - "F5 BIG-IP Observability with Dynatrace and F5 Telemetry Streaming"
Welcome back to another edition of “How I Did It.” It’s been a while since we looked at observability… Oh wait, I just said that. Anyway, in this post I’ll walk through how I integrated F5 Telemetry Streaming with Dynatrace. To show the results, I’ve included sample dashboards that highlight how the ingested telemetry data can be visualized effectively. Let’s dive in before I repeat myself again.
feedService: Automate Threat Feed and Blocklist Ingestion on BIG-IP (iApp + Python)
feedService is an iApp- and Python-based automation solution for F5 BIG-IP that automatically downloads, validates, normalizes, and imports feed data into native BIG-IP constructs — with intelligent data classification, change detection, and scheduled updates via iCall.Three Things I've Learned Recently While Deploying F5 CIS on OpenShift
Not every CIS deployment issue is actually a CIS issue. This article walks through three lessons learned from recent OpenShift deployments where the real culprit turned out to be NetworkPolicies, image selection, and version management rather than the controller itself.
