Deliver new certificates to F5 partitions

From the DigiCert® Trust Lifecycle Manager Inventory view, you can enroll new certificates with automated delivery to the partitions on a connected F5 BIG-IP LTM appliance. When you request the new certificate, Trust Lifecycle Manager:

Generates the private key and certificate signing request (CSR) in the selected F5 partition, and delivers the issued certificate to the same partition.
Adds the certificate to a new or existing Client SSL profile, depending on your request settings.

Notice

To also install the certificate on a virtual IP (VIP) on the F5 appliance as part of the certificate request, see Deploy new certificates to unsecured endpoints. To manage lifecycles of existing certificates on an F5 appliance, see Manage and renew existing certificates.

Before you begin

Add the F5 connector in Trust Lifecycle Manager for the target appliance.
Create a certificate automation profile with the Admin web request enrollment method.

Submit a certificate delivery request

Step 1: Initiate the request and configure basic settings

Start by initiating the request and configuring basic settings for the certificate to enroll and deliver.

In the Trust Lifecycle Manager menu, go to Inventory.
Select the Admin web request button at top.
On the Certificate setup screen, configure the basic certificate options:
1. Profile: Select a certificate profile to enroll from. Only profiles with the Admin web request enrollment method are included in this dropdown menu. Use the Show details link to verify the properties for the selected certificate profile.
2. Certificate information:
  Common Name: Enter a common name (CN) for the new certificate.
  Other hostnames (SANs): Enter subject alternative names to include in the new certificate, one at a time. To instead import the list of SANs from a CSV file, select the Import CSV button. This field is optional and only appears if supported by the selected certificate profile. Depending on the profile configuration, you can enter DNS names, IP addresses, or both.
3. Lifecycle & fulfillment controls:
  Issue duplicate certificate if available: For CertCentral orders, issue a duplicate certificate if the selected profile supports it and the requested common name and SANs match an existing certificate.
  Enable auto-renew schedule: Enable this option to automatically renew the certificate before expiration and deliver the new certificate to the same delivery locations. Select options for when to submit the renewal request (number of days before expiration). Selections you make here override any auto-renewal options in the certificate profile. During an auto-renewal event, the new certificate gets delivered to the same locations as the original one.
  DNS integration: Select a DNS provider from the list to automate domain control validation processes for your certificate.
4. Certificate-level settings:
  Certificate owners (optional): Select any certificate owners for the certificate. If the selected certificate profile allows it, you can add new owners as part of the request.
  Tags (optional): Apply tags to the issued certificate to help monitor and manage it in Trust Lifecycle Manager.
  Custom attributes (optional): Select any custom attributes for the certificate. This option only appears if the selected certificate profile includes the configured attributes.
5. Additional order options: Enter order handling information, not to be included in the certificate itself. This section is optional and only appears if supported by the selected certificate profile.
Select Next.

Step 2: Configure the delivery targets

On the Delivery integrations screen, select the delivery locations for the issued certificate and configure options for each.

Select the Add button to enable specific target types.
1. In the sidebar that opens, use the checkboxes to enable individual target types or Select all to enable all of them.
2. Select Apply to add the selected delivery targets to your certificate request.
The delivery targets you added appear on the left. Select each one and configure delivery options for it on the right.
sidebar. F5 BIG-IP LTM
To deliver certificates to an F5 BIG-IP LTM network appliance, configure the following options.
Connector: Select the F5 connector for the appliance to deliver certificates to.
Partition: Select the F5 partition where Trust Lifecycle Manager generates the private key and certificate signing request (CSR) and delivers the certificate.
F5 profile name: Enter the name of the Client SSL profile to use for installing the certificate on the selected F5 partition.
If a Client SSL profile with that name already exists, Trust Lifecycle Manager updates the existing profile to use the new certificate.
If there is no existing Client SSL profile with that name, enable the Create new profile if not exists option to create a new profile on the F5 for the certificate.
Important
Notes:
If you enter the name of a nonexistent profile and do not select the Create new profile if not exists option, the automation run will fail.
If the selected F5 connector has the Reuse existing intermediate CA certificate files option enabled, Trust Lifecycle Manager attempts to use an existing CA chain on the F5 when delivering the new end-entity certificate. Otherwise, it saves a new CA chain and adds it to the Client SSL profile for the certificate.
After configuring options for each deliver target, it shows as Configured on the left. When all targets are configured, select Next to proceed.

Step 3: Review and submit the request

On the Review & Submit screen, review all the options you selected and submit the request.

In this section: