ACME DNS RFC-2136 Let's Encrypt certs
I've been pushing on certbot to handle CNAME entries when ordering certs, and finally given up. https://github.com/certbot/certbot/issues/6787 https://github.com/certbot/certbot/pull/9970 https://github.com/certbot/certbot/pull/7244 This repo contains scripts that: Create an ACME account with Let's Encrypt use TSIG credentials to talk to bind (RFC-2136) create TXT record in correct zone by following CNAME and SOA entries if present downloads certs installs certs on one or more F5s. The F5 credentials requires Administrator rights as Certificate Manager can't upload files. https://github.com/timriker/certmgr CNAME records are recommended to a zone with minimal or no replication and a low TTL. ie: _acme-challenge.example.com CNAME example.com._tls.example.com _acme-challenge.example.net CNAME example.net._tls.example.com _tls.example.com would have one name server and 30 second TTL or so a TSIG key would be created that only needs update access to _tls.example.com Comments welcome. JRahm I'm looking at you. 😎 More info: https://letsencrypt.org/docs/challenge-types/
Run mkdir over iControl REST for disappearing /var/config/rest/downloads/tmp
Hello, I am currently writing the code for automating our ssl cert deployment among other things. I upload files to the Bigip device to shared/file-transfer/uploads/ This only works when the directory /var/config/rest/downloads/tmp exists. I noticed this periodically is removed again. Is there a way I can run an mkdir over REST to fix this? Regards
Remote Logging of Log Files
I've configured F5 Big IP to send logs to a remote location. However it sends several messages. I know it is possible to configure log levels from 'Options' (critical, emergency, etc.) What I want to learn that, is it possible to configure remote logging such that sends only LTM logs (I mean logs written to /var/log/ltm file, only)?
BIGIP system can't access internet with proxy
Hi, I'm trying to configure a LTM cluster to access internet through a proxy. The goal is to re-activate licence in automatic mode. I tried to configure the proxy parameters with this SOL: "Optional: If the BIG-IP system connects to the Internet using a forward proxy server, set these system database variables. Type tmsh modify sys db proxy.host value hostname to specify the host name of the proxy server. Type tmsh modify sys db proxy.port value port_number to specify the port number of the proxy server." But when I click on reactivate licence I have a timeout. If anyone had a solution. Thanks
Which attack signature sets does contain others?
My application is running on Apache Tomcat and there is one signature set with such name. Of course, I enabled it. The question is should I also enable sets referred to e.g. Apache, Java Servlets? Or maybe required signatures are containing in Apache Tomcat set already?rSeries Configuration Backup
Hi Guys, I am currently facing an issue with the F5OS backup process when a remote server is not available. My requirement is to take a configuration backup locally. At present, I am using the F5OS API to trigger the backup generation; however, in some cases—especially when the configuration size is large—the backup creation takes longer than expected or fails to complete before the subsequent download task is executed. This causes the overall workflow to fail. I believe this limitation could be addressed by allowing the remote host and remote path fields to be optional, so that backups can be generated and managed locally without dependency on an external server. This would improve reliability and flexibility, particularly for environments with large configurations or restricted infrastructure. - name: Create backup config and import it to remote server f5os_config_backup: name: foo remote_host: builds.mydomain.com remote_path: /uploads/upload.php timeout: 300 state: present Currenlty i am using below API Call. POST https://{{rseries_appliance1_ip}}/api/data/openconfig-system:system/f5-database:database/f5-database:config-backup { "f5-database:name": "F5OS-BACKUP-APPLIANCE1{{currentdate}}" } Pause 2-3mins is one of the option but Appreciate your ideas. Thanks
How to Use ACME with BIG-IP
We are terminating SSL on BIG-IP and considering using KOJOT-ACME for automatic certificate renewal. Could you explain the steps, configuration, and requirements (such as version or model) for using ACME with BIG-IP? We are struggling because we don’t know exactly what needs to be done on the BIG-IP side.
