Provision to an F5 BIG-IP LTM

1. Sign in to Next-Gen Trust Security.
2. Click Insights > Machines.
3. Select the F5 BIG-IP LTM machine you want to provision a certificate to.
4. Click Provision a certificate.
5. From Choose a certificate from the inventory, search for and select the certificate you want to provision.
   Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
6. In Certificate Name, enter the name you want the certificate to use on the F5.
   What if the certificate name is already in use?
   When provisioning a certificate, Next-Gen Trust Security checks whether the name already exists on the F5:
   • If the name is not in use, it is applied as entered.
   • If the name is already in use by the same certificate, that certificate is reused.
   • If the name is in use by a different certificate, Next-Gen Trust Security creates a new unique name by appending the expiration date and a numeric suffix (for example, my-cert-name_22Oct05_3117).
7. In Chain Bundle Name, enter the name for the CA certificate bundle.
   Note: F5 chain bundle behavior:
   • If the bundle does not exist, Next-Gen Trust Security creates it.
   • If the bundle exists and matches exactly, it is reused.
   • If the bundle exists but differs in certificates or order, provisioning fails with an overwrite error.
8. From Profile Type, select one of the following:
   • Client SSL Profile
   • Server SSL Profile
9. (Optional) In Partition, enter an existing F5 partition name.
   • If left blank, the Common partition is used.
   • Partition names are case-sensitive.
10. (Optional) In Parent Profile, enter the name of the parent profile.
    Note: This field is ignored when provisioning to an existing SSL profile. Parent profiles are not modified.
11. In SSL Profile, enter the name of the SSL profile.
    • If the profile already exists, Next-Gen Trust Security provisions the certificate to it.
    • If the profile does not exist, Next-Gen Trust Security creates a new SSL profile using the specified name.
12. (Optional) For client SSL profiles, enter an alternative DNS name in SNI.
    Warning: If you enter an SNI value when updating an existing profile, the existing SNI value is overwritten.
    Note: The Virtual Server Friendly Names list shows virtual servers currently using the selected SSL profile to help verify the correct target.
13. (Optional) To prevent the certificate from being pushed immediately, set Push upon saving to No.
14. Click Save.