Focus

Next-Gen Trust Security

Provision to an F5 BIG-IP LTM

Table of Contents

Provision to an F5 BIG-IP LTM

Tip: Before proceeding, verify that the machine is already created in Next-Gen Trust Security. Also, ensure that you’ve completed the prerequisite configuration steps for the F5 BIG-IP LTM machine.

Use this procedure to provision a certificate from Next-Gen Trust Security to an F5 BIG-IP LTM. You can provision a certificate to an existing SSL profile or allow Next-Gen Trust Security to create a new SSL profile during provisioning.

Sign in to Next-Gen Trust Security.
Click Insights > Machines.
Select the F5 BIG-IP LTM machine you want to provision a certificate to.
Click Provision a certificate.
From Choose a certificate from the inventory, search for and select the certificate you want to provision.
Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
In Certificate Name, enter the name you want the certificate to use on the F5.

What if the certificate name is already in use?

When provisioning a certificate, Next-Gen Trust Security checks whether the name already exists on the F5:

If the name is not in use, it is applied as entered.
If the name is already in use by the same certificate, that certificate is reused.
If the name is in use by a different certificate, Next-Gen Trust Security creates a new unique name by appending the expiration date and a numeric suffix (for example, my-cert-name_22Oct05_3117).

In Chain Bundle Name, enter the name for the CA certificate bundle.
Note: F5 chain bundle behavior:
- If the bundle does not exist, Next-Gen Trust Security creates it.
- If the bundle exists and matches exactly, it is reused.
- If the bundle exists but differs in certificates or order, provisioning fails with an overwrite error.
From Profile Type, select one of the following:
- Client SSL Profile
- Server SSL Profile
(Optional) In Partition, enter an existing F5 partition name.
- If left blank, the Common partition is used.
- Partition names are case-sensitive.
(Optional) In Parent Profile, enter the name of the parent profile.
Note: This field is ignored when provisioning to an existing SSL profile. Parent profiles are not modified.
In SSL Profile, enter the name of the SSL profile.
- If the profile already exists, Next-Gen Trust Security provisions the certificate to it.
- If the profile does not exist, Next-Gen Trust Security creates a new SSL profile using the specified name.
(Optional) For client SSL profiles, enter an alternative DNS name in SNI.
Warning: If you enter an SNI value when updating an existing profile, the existing SNI value is overwritten.
Note: The Virtual Server Friendly Names list shows virtual servers currently using the selected SSL profile to help verify the correct target.
(Optional) To prevent the certificate from being pushed immediately, set Push upon saving to No.
Click Save.

After saving, Next-Gen Trust Security provisions the certificate to the specified F5 SSL profile and creates an installation record on the Installations tab. If a new profile was created, it is ready to be assigned to a virtual server or HTTPS health monitor.

Note: Each time you renew and reprovision a certificate to an F5 BIG-IP LTM profile, Certificate Manager - SaaS automatically manages certificate generations on the F5 device.

The newly provisioned certificate becomes the active version.
The previously active certificate is retained as a rollback version.
Older certificate generations deployed by Certificate Manager - SaaS are automatically removed, as long as they are not currently assigned to another SSL profile.
This cleanup happens automatically in the connector and does not require additional configuration.

Provision Certificates to Machines

Provision to a Microsoft Azure Private Key Vault