Use this procedure to provision a certificate from Next-Gen Trust Security to a Barracuda Web Application Firewall (WAF) and activate it on a service.
Next-Gen Trust Security provisions RSA and ECDSA server certificates. Trusted CA, trusted server, and self-signed certificates are discovered but can't be provisioned.
Sign in to Next-Gen Trust Security.
Click Insights > Certificate Installations > Machines.
Click the more options button at the right end of the Barracuda WAF machine's row, and then select Provision.
In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.
Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.
Under Certificate Information, in Certificate Name, enter the name to store the certificate under on the appliance.
Note:
Next-Gen Trust Security adds a fingerprint suffix to the name, for example web-prod-3f9a1c07b2e4. The suffix is the first 12 characters of the certificate's SHA-256 fingerprint, so it doesn't match the Certificate SHA1 Fingerprint you reviewed when selecting the certificate. The same certificate always gets the same name, so retrying a provision reuses the existing certificate. A renewed certificate gets a new name.
In the name you enter, letters, numbers, hyphens, and underscores are kept, and each run of other characters becomes a single hyphen. If the full name would be longer than 64 characters, Next-Gen Trust Security shortens the part you entered so the suffix still fits.
From Certificate Type, select Signed Certificate.
Note: Next-Gen Trust Security always stores provisioned certificates as signed certificates. The other types in this list identify certificates found during discovery.
Under Server Store Details, from Binding Type, select where on the appliance to use the certificate:
Service Default Certificate: The service's default certificate.
SNI Domain Certificate: The certificate for one domain on a service that serves several domains.
Unbound: Uploads the certificate to the appliance without activating it on a service.
If you selected any binding type other than Unbound, enter the following:
If you selected SNI Domain Certificate, enter the domain in Domain. If the domain isn't already configured on the service, Next-Gen Trust Security adds it.
If you selected any binding type other than Unbound, from Certificate Slot, select RSA or ECDSA.
Important: Select the slot that matches the certificate's key type. Provisioning fails if they don't match.
(Optional) To save without pushing the certificate now, turn off Push certificate on save. It's on by default.
Click Save.
After saving, Next-Gen Trust Security uploads the certificate to the appliance, activates it on the service or domain you selected, and creates an installation record on the Installations tab. Other certificate assignments on the service stay unchanged.
