ACME DNS RFC-2136 Let's Encrypt certs
I've been pushing on certbot to handle CNAME entries when ordering certs, and finally given up. https://github.com/certbot/certbot/issues/6787 https://github.com/certbot/certbot/pull/9970 https://github.com/certbot/certbot/pull/7244 This repo contains scripts that: Create an ACME account with Let's Encrypt use TSIG credentials to talk to bind (RFC-2136) create TXT record in correct zone by following CNAME and SOA entries if present downloads certs installs certs on one or more F5s. The F5 credentials requires Administrator rights as Certificate Manager can't upload files. https://github.com/timriker/certmgr CNAME records are recommended to a zone with minimal or no replication and a low TTL. ie: _acme-challenge.example.com CNAME example.com._tls.example.com _acme-challenge.example.net CNAME example.net._tls.example.com _tls.example.com would have one name server and 30 second TTL or so a TSIG key would be created that only needs update access to _tls.example.com Comments welcome. JRahm I'm looking at you. 😎 More info: https://letsencrypt.org/docs/challenge-types/
Run mkdir over iControl REST for disappearing /var/config/rest/downloads/tmp
Hello, I am currently writing the code for automating our ssl cert deployment among other things. I upload files to the Bigip device to shared/file-transfer/uploads/ This only works when the directory /var/config/rest/downloads/tmp exists. I noticed this periodically is removed again. Is there a way I can run an mkdir over REST to fix this? Regards
Remote Logging of Log Files
I've configured F5 Big IP to send logs to a remote location. However it sends several messages. I know it is possible to configure log levels from 'Options' (critical, emergency, etc.) What I want to learn that, is it possible to configure remote logging such that sends only LTM logs (I mean logs written to /var/log/ltm file, only)?
BIGIP system can't access internet with proxy
Hi, I'm trying to configure a LTM cluster to access internet through a proxy. The goal is to re-activate licence in automatic mode. I tried to configure the proxy parameters with this SOL: "Optional: If the BIG-IP system connects to the Internet using a forward proxy server, set these system database variables. Type tmsh modify sys db proxy.host value hostname to specify the host name of the proxy server. Type tmsh modify sys db proxy.port value port_number to specify the port number of the proxy server." But when I click on reactivate licence I have a timeout. If anyone had a solution. Thanks
Which attack signature sets does contain others?
My application is running on Apache Tomcat and there is one signature set with such name. Of course, I enabled it. The question is should I also enable sets referred to e.g. Apache, Java Servlets? Or maybe required signatures are containing in Apache Tomcat set already?
Local-Only in your browser BIG-IP Report Generator
Leveraging my f5query engine and the Python interface to it, along with my Tcl-LSP Tcl/iRule compiler and analyser, I built a report generator. You can run it locally yourself, it's a single HTML file that embeds all the WASM to do the work, makes no requests to the outside world. I don't have good lab devices to use for demo content anymore so I had to use some SCF files I found on GitHub for the demo. Example Report Report Generator - nothing is ever uploaded, there's no telemetry, the only external URL in it is in the footer pointing to my GitHub. It should have somewhat decent print output. If you have feature requests, bug reports, please open issues on GitHub This work only exists in the rust branch and 2.x pre-releases if you're interested in the code.
