F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP LTM
  4. BIG-IP Digital Certificates: Administration
  5. Device Certificate Management
Manual Chapter : Device Certificate Management

Applies To:

Show Versions Show Versions

BIG-IP AAM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP APM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP Link Controller

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP LTM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP PEM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP AFM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP DNS

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0

BIG-IP ASM

  • 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
Manual Chapter
Table of Contents | Next Chapter >>

About BIG-IP device certificates and keys

Before BIG-IP systems can exchange data with one another, they need to exchange device certificates, that is, digital certificates and keys used for secure communication. For example, multiple BIG-IP systems might need to verify credentials before communicating with each other to collect performance data over a wide area network, for global traffic management.

A default device certificate and key are located in these directories on the BIG-IP system:

Device certificate file
/config/httpd/conf/ssl.crt/server.crt
Device key file
/config/httpd/conf/ssl.key/server.key
Note: The BIG-IP system offers a certificate management user role for managing digital certificates on the BIG-IP system.

Device certificate requirements

BIG-IP devices use SSL certificates for authentication and communication among BIG-IP devices on the network. For this authentication and communication between BIG-IP devices to function properly, you should be aware of the following:

  • Device certificates must reside in the correct locations on each BIG-IP system.
  • Device certificates must be valid and must not be expired.
  • BIG-IP device group members require unique device certificates that you must maintain and renew independently.
  • You must manage device certificates for any BIG-IP Global Traffic Manager (GTM) deployment.
  • You must manage device certificates for any BIG-IP Application Acceleration Manager (AAM) symmetric deployment.
  • For GTM deployments and AAM symmetric deployments, if you update or renew device certificates after they have expired, you must ensure that you copy the new certificates to the remote BIG-IP devices. BIG-IP devices exchange device certificates when running these scripts: bigip_add (GTM and AAM) big3d_install (GTM only)

About trusted device certificates

The BIG-IP system uses a trusted device certificate or a certificate chain to authenticate another system. For example, a BIG-IP system running Global Traffic Manager system might send a request to a Local Traffic Manager system. In this case, the Local Traffic Manager system receiving the request checks its trusted device certificate or certificate chain to authenticate the request.

BIG-IP device certificate management

There are several tasks you can perform to manage device certificates on the BIG-IP system.

Task list

Importing a device certificate

You can use the Configuration utility to import a device certificate from a management workstation.
  1. On the Main tab, click System > Device Certificates. The Device Certificate screen opens.
  2. Click Import.
  3. From the Import Type list, select Certificate.
  4. For the Certificate Source setting, select Upload File and browse to select the certificate to upload.
  5. Click Import.

Renewing a device certificate

You can use the Configuration utility to renew a device certificate that has expired.
  1. On the Main tab, click System > Device Certificates. The Device Certificate screen opens.
  2. Click Renew.
  3. Modify or retain the device certificate properties.
  4. Click Finished.

Exporting a device certificate

You can use the Configuration utility to export a device certificate to a management workstation.
  1. On the Main tab, click System > Device Certificates. The Device Certificate screen opens.
  2. Click Export.
  3. Click Download server.crt to export a copy of the device certificate to the management workstation.

Importing a device certificate/key pair

You can use the Configuration utility to import a device certificate/key pair from a management workstation.
  1. On the Main tab, click System > Device Keys. The Device Key screen opens.
  2. Click Import.
  3. From the Import Type list, select Certificate and Key.
  4. For the Certificate Source setting, select Upload File and browse to select the certificate to upload.
  5. For the Key Source setting, select Upload File and browse to select the key to upload.
  6. Click Import.
Table of Contents | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information