Manual Chapter :
SSL Certificate Management
Applies To:
Show Versions![Show Versions](/etc/designs/pcx/techdocs/images/expandversions.gif)
BIG-IP AAM
- 14.0.1, 14.0.0
BIG-IP APM
- 14.0.1, 14.0.0
BIG-IP Analytics
- 14.0.1, 14.0.0
BIG-IP Link Controller
- 14.0.1, 14.0.0
BIG-IP LTM
- 14.0.1, 14.0.0
BIG-IP PEM
- 14.0.1, 14.0.0
BIG-IP AFM
- 14.0.1, 14.0.0
BIG-IP DNS
- 14.0.1, 14.0.0
BIG-IP ASM
- 14.0.1, 14.0.0
SSL Certificate Management
Supported certificate/key types
The BIG-IP® system supports multiple cipher suites when offloading SSL operations
from a target server on the network. The BIG-IP system can support cipher suites that use these
algorithms:
- Rivest Shamir Adleman (RSA)
- Elliptic Curve Digital Signature Algorithm (ECDSA)
- Digital Signature Algorithm (DSA)
When you generate a certificate request or a self-signed certificate, you specify the type of
private key, which determines the specific signing or encryption algorithm that is used to
generate the private key.
On the BIG-IP system, limits on SSL transactions per second (TPS) with RSA cipher
suites vary according to key size.
About RSA certificates
RSA
(Rivest Shamir Adleman) is the original encryption algorithm that is based on
the concept of a public and a private key. When a public site attempts to communicate with a
device such as the BIG-IP® system, the device sends the site a public key that the site uses to
encrypt data before sending that data back to the device. The device uses its private key
associated with the public key to decrypt the data. Only the private key can be used to decrypt
data encrypted with the public key.The RSA encryption algorithm includes an authentication mechanism.
On the BIG-IP system, limits on SSL transactions per second (TPS) with RSA cipher
suites vary according to key size.
About DSA
certificates
DSA (Digital Signature Algorithm) uses a different algorithm for signing
key exchange messages than that of RSA.
DSA
is paired with a
key exchange method such as Diffie-Hellman or Elliptical Curve Diffie-Hellman to achieve a
comparable level of security to RSA. Because DSA is generally endorsed by federal agencies,
specifying a DSA key type makes it easier to comply with new government standards, such as those
for specific key lengths. About ECDSA
certificates
When creating certificates on the BIG-IP system, you can create a certificate with a key type of ECDSA (Elliptic Curve
Digital Signature Algorithm). An
ECDSA key
is based on
Elliptic Curve Cryptography (ECC), and provides better security and performance with
significantly shorter key lengths.Encryption based on ECC is ideally suited for mobile devices that cannot
store large keys.
For example, an RSA key size of 2048 bits is equivalent to an ECC key size
of only 224 bits. As a result, less computing power is required, resulting in faster, more secure
connections. The BIG-IP system supports the eilliptic curves prime256v1, secp384r1, and
secp521r1.
The elliptic curve secp521r1 is not supported on the F5®
10350v-FIPS hardware platform.
About SSL certificate management
You can obtain a certificate for the BIG-IP system by using the BIG-IP®
Configuration utility to generate a certificate signing request (CSR) that can then be submitted
to a third-party trusted certificate authority (CA). The CA then issues a signed certificate.
In addition to requesting CA-signed certificates, you can create self-signed certificates. You
create self-signed certificates primarily for testing purposes within an organization.
When you install the BIG-IP software, the application includes a default self-signed
certificate. The BIG-IP system also includes a default CA bundle certificate. This certificate
bundle contains certificates from most of the well-known CAs.
To manage digital certificates for the BIG-IP system, you must have a role of
Certificate Manager, Administrator, or Resource Administrator assigned to your BIG-IP user
account.
Creating a self-signed certificate that contains an ECDSA key type
You can use this task to create a self-signed certificate with an ECDSA key type. The certificate is used to authenticate and secure either
client-side or server-side HTTP traffic.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- ClickCreate.
- In theNamefield, type a unique name for the SSL certificate.
- From the Issuer list, selectSelf.
- In theCommon Namefield, type a name.This is typically the name of a web site, such aswww.siterequest.com.
- In theDivisionfield, type your department name.
- In theOrganizationfield, type your company name.
- In theLocalityfield, type your city name.
- In the orState or Provincefield, type your state or province name.
- From theCountrylist, select the name of your country.
- In theE-mail Addressfield, type your email address.
- In theLifetimefield, type a number of days, or retain the default,365.
- In theSubject Alternative Namefield, type a name.This name is embedded in the certificate for X509 extension purposes.By assigning this name, you can protect multiple host names with a single SSL certificate.
- From theKey Typelist, selectECDSA.
- From theCurvelist, select an elliptic curve:prime256v1Creates a key that is 256 bits in lengthsecp384r1Creates a key that is 384 bits in lengthsecp521r1Creates a key that is 521 bits in lengthIn general, longer keys can impact performance but are more secure. Shorter keys result in better performance but are less secure.
- ClickFinished.The name of the self-signed certificate appears in the list of certificates on the system.
Requesting a CA-signed
certificate that contains an ECDSA key type
You can generate a certificate that includes an Elliptic Curve Digital Signature
Algorithm (ECDSA) key type, and then copy it or submit it to a trusted certificate
authority for signature.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- ClickCreate.
- In theNamefield, type a unique name for the SSL certificate.
- From theIssuerlist, selectCertificate Authority.
- In theCommon Namefield, type a name.This is typically the name of a web site, such aswww.siterequest.com.
- In theDivisionfield, type your department name.
- In theOrganizationfield, type your company name.
- In theLocalityfield, type your city name.
- In the orState or Provincefield, type your state or province name.
- From theCountrylist, select the name of your country.
- In theE-mail Addressfield, type your email address.
- In theLifetimefield, type a number of days, or retain the default,365.
- In theSubject Alternative Namefield, type a name.This name is embedded in the certificate for X509 extension purposes.By assigning this name, you can protect multiple host names with a single SSL certificate.
- In theChallenge Passwordfield, type a password.
- In theConfirm Passwordfield, re-type the password you typed in theChallenge Passwordfield.
- From theKey Typelist, selectECDSA.
- From theCurvelist, select an elliptic curve:prime256v1Creates a key that is 256 bits in lengthsecp384r1Creates a key that is 384 bits in lengthsecp521r1Creates a key that is 521 bits in lengthIn general, longer keys can impact performance but are more secure. Shorter keys result in better performance but are less secure.
- Do one of the following to download the request into a file on your system.
- In theRequest Textfield, copy the certificate.
- ForRequest File, click the button.
- Follow the instructions on the relevant certificate authority web site for either pasting the copied request or attaching the generated request file.
- ClickFinished.The Certificate Signing Request screen displays.
The generated certificate is submitted to a trusted certificate authority for
signature.
Creating a FIPS-type self-signed certificate
You can use this task to create a self-signed certificate to authenticate and secure either
client-side or server-side HTTP traffic.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- ClickCreate.
- In theNamefield, type a unique name for the SSL certificate.
- From the Issuer list, selectSelf.
- In theCommon Namefield, type a name.This is typically the name of a web site, such aswww.siterequest.com.
- In theDivisionfield, type your department name.
- In theOrganizationfield, type your company name.
- In theLocalityfield, type your city name.
- In the orState or Provincefield, type your state or province name.
- From theCountrylist, select the name of your country.
- In theE-mail Addressfield, type your email address.
- In theLifetimefield, type a number of days, or retain the default,365.
- In theSubject Alternative Namefield, type a name.This name is embedded in the certificate for X509 extension purposes.By assigning this name, you can protect multiple host names with a single SSL certificate.
- From theSecurity Typelist, selectFIPS.
- From theKey Typelist, selectRSA,DSA, orECDSA.
- If you selectedECDSA, then from theCurvelist, select an elliptic curve.The elliptic curve secp521r1 is not supported on the F5® 10350v-FIPS hardware platform.
- ClickFinished.The name of the self-signed certificate appears in the list of certificates on the system.
Requesting a FIPS-type CA-signed certificate
Use this task to create a request for a certificate with
FIPS type security from a certificate authority.
- On the Main tab, click.This displays the list of certificates installed on the system.
- ClickCreate.The New SSL Certificate screen opens.
- In theNamefield, type a unique name for the certificate.
- From theIssuerlist, specify the type of certificate that you want to use.
- To request a certificate from a CA, selectCertificate Authority.
- For a self-signed certificate, selectSelf.
- Configure theCommon Namesetting and any other settings as needed.
- From theSecurity Typelist, selectFIPS.
- From theKey Typelist, selectRSA,DSA, orECDSA.
- If you selectedECDSA, then from theCurvelist, select an elliptic curve.The elliptic curve secp521r1 is not supported on the F5 10350v-FIPS hardware platform.
- ClickFinished.
Converting a key to FIPS format
You can use the BIG-IP Configuration utility to
convert an existing key to a FIPS key.
- On the Main tab, click
- Click a certificate name.This displays the properties of that certificate.
- On the menu bar, clickKey.This displays the type and size of the key associated with the certificate.
- ClickConvert to FIPSto convert the key to a FIPS key.The key is converted and appears in the list as a FIPS key. After the key is converted, this process cannot be reversed.
About SSL file import
You can import several types of SSL files onto the BIG-IP system.
Importing a certificate signed by a certificate authority
Before performing this task, confirm that a digital certificate signed by a
certificate authority (CA) is available.
You can install an SSL certificate signed by a CA by importing a certificate that
already exists on the hard drive of the management workstation. You can import a private
key, a certificate or certificate bundle, or an archive.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- Click theImportbutton.
- From theImport Typelist, selectCertificate.
- For theCertificate Namesetting:
- If you are importing a new certificate, selectCreate Newand type a unique name in the field.
- If you are replacing an existing certificate, selectOverwrite Existingand select a certificate name from the list.
- For theCertificate Sourcesetting, do one of the following:
- Select theUpload Fileoption, and browse to the location of the certificate file.
- Select thePaste Textoption, and paste the certificate text copied from another source.
- ClickImport.
After you perform this task, the SSL certificate that was signed by a CA is
installed.
Importing an SSL key
You can use the BIG-IP Configuration utility to import an SSL
key onto the BIG-IP system from another location.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- Click theImportbutton.
- From theImport Typelist, selectKey.
- For theKey Namesetting, do one of the following:
- Select theCreate Newoption, and type a unique name in the field.
- Select theOverwrite Existingoption, and select a certificate name from the list.
- For theKey Sourcesetting, do one of the following:
- Select theUpload Fileoption, and browse to the location of the key file.
- Select thePaste Textoption, and paste the key text copied from another source.
- In thePasswordfield, type the password associated with the import source.
- from theSecurity Typelist, select a security type.
- ClickImport.
After you perform this task, the BIG-IP system imports the specified key.
Importing a PKCS-formatted file
You can use the BIG-IP Configuration utility to import file
onto the BIG-IP system that is in Public Key Cryptography Standards (PKCS) number 12
format.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- Click theImportbutton.
- From theImport Typelist, selectPKCS 12 (IIS).
- For theCertificate Namesetting, type a certificate name.
- For theCertificate Sourcesetting, clickBrowseand locate the source file.
- In thePasswordfield, type the password associated with the import source.
- from theSecurity Typelist, select a security type.
- ClickImport.
After you perform this task, the BIG-IP system imports the specified PKCS
12-formatted file.
Importing an archive file
You can use the BIG-IP Configuration utility to upload an
archive file onto the BIG-IP system.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- Click theImportbutton.
- For theUpload Archive Filesetting, clickBrowseand select the file to be imported.
- Click theLoadbutton.
After you perform this task, the BIG-IP system uploads an archive file onto the
BIG-IP system.
Exporting an SSL certificate
You perform this task to export an SSL certificate to another device.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- Click the name of the certificate you want to export.The General Properties screen displays.
- ClickExport.The Certificate Export screen displays the contents of the certificate in theCertificate Textbox.
- To obtain the certificate, do one of the following:
- Copy the text from theCertificate Textfield, and paste it as needed into an interface on another system.
- At theCertificate Fileoption, clickDownload filenamewhere the filename is the name of the certificate file, such asmycert.crt.
Viewing a list of certificates on the system
You can perform this task to view a list of existing digital certificates on the BIG-IP system.
- On the Main tab, click.The Traffic Certificate Management screen opens.
- In the Name column, view the list of certificates on the system.
Digital SSL certificate properties
From the BIG-IP Configuration utility, you can see the properties
of the SSL digital certificates you have installed on the BIG-IP
system.
Property |
Description |
---|---|
Certificate |
The name of the certificate. |
Content |
The type of certificate content, for example, Certificate Bundle or Certificate and
Key. |
Common name |
The common name (CN) for the certificate. The common name embedded in the certificate is
used for name-based authentication. The default common name for a self-signed certificate is
localhost.localdomain . |
Expiration date |
The date that the certificate expires. If the certificate is a bundle, this information shows the range of expiration dates that apply to certificates in the bundle. |
Organization |
The organization name for the certificate. The organization name embedded in the certificate
is used for name-based authentication. The default organization for a self-signed certificate
is MyCompany . |
About certificate
bundle management
You can use the bundle manager to automatically update and install
certificate authority (CA) bundles on the system from two sources: local certificate file objects
and remote URL resources. By using the
Include
Bundles
and Include URLs
options, you can combine CA certificates from various sources to create a new, customized CA
bundle. You can also use the Exclude
Bundles
and Exclude URLs
options to remove certain CA certificates from the resulting CA bundle file. The newly created or
modified CA bundle file is installed as a certificate-file-object on the system and used as a
trusted CA bundle by other modules.In addition, you can set the update frequency of the CA bundle, or use a web
proxy for downloading the remote URL resources. By default, a newly created CA bundle manager
does not create or update the managed CA bundle object. Exceptions are if the CA bundle manager
has a positive update interval or is explicitly told to do so since you have set the
Update Now
option.Creating a new certificate bundle
You can create a new certificate authority (CA) bundle, and specify bundles and URLs
to include or exclude. You can also set the update frequency of the CA bundle, or
use a web proxy for downloading the remote URL
resources.
The resulting bundle file will be
named the same as the bundle manager object.
By default, a newly created CA
bundle manager does not create or update the managed CA bundle object unless the CA
bundle manager has a positive
Update Interval
or is
explicitly told to do so by the Update Now
option.- On the Main tab, click.The Bundle Manager List screen opens.
- ClickCreate.
- From theInclude BundlesAvailablelist, select the certificate file objects to include for generating a new CA bundle.
- In theInclude URLsfield, type the URL where remote CA bundles reside, and clickAddto include that for generating the new CA bundle.Only HTTPS URLs are allowed in theInclude URLsfields.
- From theExclude BundlesAvailablelist, select the certificate file objects to exclude from the new CA bundle.
- In theExclude URLsfield, type the URL where remote CA bundles reside, and clickAddto exclude it from the new CA bundle.Only HTTPS URLs are allowed in theExclude URLsfields.
- In theUpdate Intervalfield, type the number of days at which to refresh the remote CA bundles at the URLs.The default value is set to0and indicates that the generated CA bundle is not dynamically updated.
- If you want the CA bundle manager to immediately refresh its generated CA bundle from all its sources and recalculate its certificate contents, select theUpdate Nowcheck box.The default value is disabled.
- From theTrusted CA-Bundlelist, select the CA bundle that this CA bundle manager will use to download remote CA bundles in the include and exclude URLs.
- In theProxy Serverfield, type the host name or IP address of the proxy server for accessing remote URL resources.Only HTTP proxy is supported. You may optionally prependhttp://to the host name or IP address.
- In theProxy Server Portfield, type the port number of the proxy server for accessing remote URL resources.The default is3128.
- In theDownload Timeoutfield, specify the timeout period, in seconds, to download the remote CA bundles from the URLs.The value range is from 1 to 3600 (1 hour) seconds.The default value is8seconds.
- ClickFinished.
The system installs a generated CA
bundle file as a certificate-file-object on the system to be used as a trusted CA bundle
by other modules.
Modifying an existing certificate
bundle
You can use the bundle manager to modify an existing certificate authority (CA)
bundle.
- On the Main tab, click.The Bundle Manager List screen opens listing all existing CA bundles and their name, update interval, proxy server, trusted CA-bundle, and partition/path details.
- From theBundle Manager List, click the name of the CA bundle that you want to modify.The Properties screen opens showing the selected CA bundle general properties and configuration details
- Select theUpdate Nowcheck box if you want the bundle to be updated.
- Modify any of the configuration details needed, and clickUpdate.
The system updates the selected CA
bundle’s configuration with the modified configuration details.
Deleting an existing certificate
bundle
You can use the bundle manager to
delete an existing certificate authority (CA) bundle.
- On the Main tab, click.The Bundle Manager List screen opens listing all existing CA bundles and their name, update interval, proxy server, trusted CA-bundle, and partition/path details.
- Select the check box next to the name of the CA bundle that you want to delete.
- ClickDelete.You can also delete a CA bundle on the Properties screen by clickingDeleteat the bottom of the screen.Deleting the CA bundle manager does not delete the managed CA bundle file object. You should delete the CA bundle file object separately or you might receive an error message indicating that your managed CA bundle file object is referenced by a CA bundle manager.
This deletes the selected CA bundle
from the system.