Create certificate automation profiles

You can manage and automate certificate lifecycles on an F5 BIG-IP LTM directly from the DigiCert® Trust Lifecycle Manager web console. Trust Lifecycle Manager handles the certificate issuance and renewal requests and installs the issued certificates on the F5 virtual IPs.

To get started, you need to create certificate automation profiles in Trust Lifecycle Manager to specify which issuing CAs to use and types of certificates to issue from them.

Overview of certificate automation profiles

Certificate automation profiles define specific types of certificates you can issue and manage using DigiCert® Trust Lifecycle Manager automation services. Each certificate profile defines options such as the:

Issuing CA
Enrollment method
Key algorithm and size
Supported certificate fields

You create different profiles for different types of certificates you want to automate through Trust Lifecycle Manager.

Notice

Each certificate profile in Trust Lifecycle Manager defines a single issuing CA and type of certificate you can issue. You can use the certificate profile to request and manage that type of certificate across a variety of systems, including F5 BIG-IP LTMs and other network appliances and cloud services connected to your Trust Lifecycle Manager account.

Profile creation workflow

Follow these workflow steps to create a new certificate profile in Trust Lifecycle Manager:

From the Trust Lifecycle Manager, select Policies > Certificate profiles.
Select the button to Create profile from template.
Select an available base template to use to create the new profile. The choice of template depends on:
- The CA to issue certificates from. For issuing CAs outside of DigiCert Private CA, you need a CA connector.
- The use case for the certificates, including the type of end-entity to secure and how the certificates will be enrolled and deployed.
Work through the profile creation wizard, selecting options for how to issue and manage certificates from this profile.
Select Next to move to the next screen, or Back to move back and review or change your selections on previous screens.
On the final screen, select Create to finish creating the new certificate profile.

For profile options specific to F5 appliances, review the following sections.

Available base templates

To create a certificate profile in Trust Lifecycle Manager, you start with a base template and customize it for your organization's digital trust needs. Available templates include those in the following table.

Template name	Trust type	Issuing CA	CA connector
`AWS CA Private Server Certificate`	Private	AWS Private CA	AWS Private CA
`CA Manager Private Server Certificate`	Private	DigiCert® Private CA	N/A
`CertCentral Private Server Certificate`	Private	DigiCert CertCentral®	CertCentral
`CertCentral Public Server Certificate`	Public	DigiCert CertCentral®	CertCentral
`EJBCA Private Server Certificate`	Private	EJBCA	EJBCA
`GlobalSign Public CA Server Certificate`	Public	GlobalSign	GlobalSign
`Let's Encrypt Public Server Certificate`	Public	Let's Encrypt	Let's Encrypt
`Microsoft CA Private Server Certificate`	Private	Microsoft	Microsoft CA
`Sectigo Public CA Server Certificate`	Public	Sectigo	Sectigo
`Step CA Private Server Certificate`	Private	Step CA	Step CA

Enrollment methods

To manage certificates on an F5 appliance, select one of the following enrollment methods for each certificate profile. Both enrollment methods use the DigiCert sensor assigned to the F5 connector to communicate securely with the appliance and manage certificate lifecycles on an ongoing basis. They differ in how they support requests for new certificates.

Enrollment method	New certificate requests
`DigiCert sensor`	Request certificates for F5 virtual IPs (VIPs) that don’t have certificates installed. Trust Lifecycle Manager installs the certificate in the VIP’s partition, adds it to a Client SSL profile, and attaches the profile to the VIP. For details, see Deploy new certificates to unsecured endpoints.
`Admin web request`	Request certificates with automated delivery to an F5 partition, without installing them on a VIP. Trust Lifecycle Manager delivers the certificate to a Client SSL profile on the selected partition, but doesn’t attach the profile to a VIP. For details, see Deliver new certificates to F5 partitions.

Auto-renewal

Enable the auto-renew option to prevent outages and make sure you always have valid certificates installed on your systems.

You specify how far in advance of expiration to submit renewal requests, and Trust Lifecycle Manager automatically renews and deploys each certificate to its installed location(s) at that time.

You enable auto-renewal in the Certificate options > Renewal options section of the profile configuration wizard. You can schedule auto-renewal for:

30 days before certificate expiration: This is the default option.
Custom schedule: Specify the number of days before expiration to renew certificates, and the specific time to submit the request.

Notifications

In addition to account-wide notifications, you can enable notifications for certificates issued from a specific certificate profile.

To enable profile-specific notifications, make selections in the Additional options > Email configuration and notifications section of the profile configuration wizard:

Select who to send the notifications to (requester and/or other recipients) for this profile. For other recipients, enter the email addresses.
Toggle on the Use custom template option for any automation events that should use custom notifications.
Customize the notification options for the event for certificates issued from this profile:
1. Edit the email subject or body for notifications.
2. Use the Send email notification checkbox to turn the event notifications on or off.
3. For renewal events, use the additional checkboxes under Renewal options to configure when the notifications get sent.

What's next

Once you have one or more certificate profiles, you can start using Trust Lifecycle Manager to automate management of the certificates installed on your F5 BIG-IP LTM appliance:

In this section: