Configuring an F5 LTM Advanced application object

To enable Trust Protection Foundation to manage PEM files installed on BIG-IP F5 LTM network appliances using the iControl API, you must configure the F5 LTM Advanced application object. This object provides the information Trust Protection Foundation needs to monitor, enroll, or provision PEM files on associated network appliances.

To see a list of supported provisioning drivers, see Certificate installation (provisioning) driver support.

Limitations of Trust Protection Foundation and the F5 LTM Advanced driver

Overwrite Certificate and Key	Assets that are in use cannot be overwritten and replaced.
Delete Previous Cert and Key	Does not use generational management.
Password-encrypted private keys	Onboard Discovery cannot import this type of key.
Certificate Partition	Profile and certificate can exist in different partitions; but this configuration is not supported for provisioning and will result in Onboard Validation failures.
Onboard Validation	Does not validate the virtual server and profile associations of the certificate
SNI	SNI (Server Name Indication) profiles are supported by Trust Protection Foundation and the F5 LTM Advanced driver. NOTE  You can use the Palo Alto Networks driver to introduce SNI configurations even if they do not yet exist on F5, provided that they do not affect existing F5 settings. Also, you cannot overwrite existing F5 settings.

To create and configure an F5 LTM Advanced application object

1. From the Certificate Manager menu bar, click Policy tree.

2. In the Policy tree, select the device object to which you want to add the new application object, and then click Add > Application, and then select F5LTM .

3. When the new application object page appears, then under Status, clear the Processing Disabled checkbox.

   When checked, this option disables provisioning of the certificates installed on the current application. This means that Trust Protection Foundation does not attempt to install, renew, process, or validate certificates on the application.

4. (Optional) In the Device Certificate box, click to select and associate a certificate with the new application.

   NOTE  If you don't have a certificate ready, you can do this later or you can do it on the certificate's Association tab.

   To associate a certificate with the current application, you must have write permissions to the application object and either write or associate permissions to the certificate object.

   For detailed information on associating a certificate with an application, see Associating a certificate with an application object.

5. Under General, do the following:

   1. In the Application Name field, type a name for the new application.

   2. (Optional) In the Description field, type a description for the purpose of the application.

      A strong description can help to provide context for other administrators who might need to manage the new application.

   3. In the Contacts field, select user or group identities you want assigned to this application object (or choose the Use policy value to configure contacts using a policy).

      Default system notifications are sent to the contact identities. The default contact is the master administrator.

      TIP  If the Identity Selector dialog is not populated when it first opens, enter a search query to retrieve the Identity list. The administration console does not automatically display external users and groups. You must first enter a search string so Trust Protection Foundation can query the external Identity store, then return the list of requested users or groups. If you want to display all user or group entries, enter the wildcard character (*).

      Press Shift+click to select multiple, contiguous users and groups. Press Ctrl+click to select multiple, discontiguous users and groups.

   4. In the Approvers field, select user or group Identities you want to assign to approve workflows (certificate approval or injection command) for the new application.

      The default approver is the master administrator. For more information on defining workflow objects, see Implementing certificate workflow management.

   5. (Conditional) If your application (or certificate) object is affected by a defined workflow and you want users to use a console other than Policy Tree, click Managed By and select which administration console to use as part of the workflow.

      You only need to configure this if you are using workflows and expect users to perform a task using a particular administration console. The default setting is Policy Tree.

      For more information, see Specify folders and certificates to be managed by Certificate Manager .

6. Under Application Information, do the following:

   1. Click next to Application Credential to browse for the credential object that you want to use to authenticate with the application.

      DID YOU KNOW?  Credential objects store the credentials Trust Protection Foundation uses to authenticate with devices, applications, and CAs. The stored credential might be a user name or private key credential; some drivers—such as F5, which is not SSH-based—can only use the user name credential for authentication.

      NOTE  The user account you select must have Read and Write access to the Temporary, Private Key, and Certificate directories.

      For more information, see Working with system credentials.

      DID YOU KNOW?  The Connection Method is the protocol that Trust Protection Foundation uses to connect to the server and manage the certificates installed on that server. In an application object's settings, this field is typically read-only.

   2. (Read Only) The iControl Version field shows the last detected version of iControl when the driver was connected to the F5 host device/application.
   3. Click the Connection Method list, click the protocol to use—HTTPS or SSH—and then in the Port field, specify the associated port number.

   4. In the HTTPS Port field, type the port that Trust Protection Foundation should use to communicate with your appliance.

      DID YOU KNOW?  By default, all communication between the F5 LTM Advanced driver and F5 (iControl) is done using port 443 except for Workflow command injection, which uses port 22 (SSH) by default. However, workflow command injection isn’t commonly used with F5 for several reasons, including the following:

      • The F5 driver is robust enough that it typically does not require additional functionality
      • Would require elevated permissions
      • Would also require command line access

   5. (Conditional) In the SSH Port field, specify the port number that Trust Protection Foundation should use to communicate with the appliance via an SSH connection.

      The default SSH port assignment is 22.

7. Complete the F5 F5 LTM Advanced Advanced application settings by referring to the following table:

   Field	Policy	Description
   Certificate & Key Settings		The following are server-specific certificate settings. They are referenced only when you associate a certificate with subordinate BIG-IP F5 LTM Application objects.
   Device Certificate		Select this option if you wish to provision the F5 F5 LTM Advanced's iControl console management certificate.
   Provisioning Mode		This setting overrides all provisioning settings except for Certificate & Key Settings. It provisions the PEM file that contains a certificate, private key, and (optional) chain bundle to the F5 Big IP LTM keystore. This setting requires the Certificate Manager user role on the LTM. If you want encryption, be sure to configure the Private Key Credential. Otherwise, the private key is non-encrypted. Choose the Provisioning Mode: Advanced: This is the default and it not only provisions the certificate, private key, and (optionally) chain bundle, it binds those assets to an SSL profile and, if the SSL profile doesn’t already exist, it creates the profile and assigns it to a virtual server Basic with configurable Certificate Name: This only provisions the certificate, private key, and (optionally) chain bundle and it allows for the user to specify their own name for the certificate. If an existing certificate is found with the requested name then a numeric suffix will be appended to the name until uniqueness is achieved. Basic with automatic Certificate Name: This only provisions the certificate, private key, and (optionally) chain bundle and uses the same automatic naming convention used by Advanced to ensure the certificate name is unique. The naming convention is: <Common Name>-<Expiration Date as DDMMMYY>-<Serial Number> If the Common Name results in a name that would exceed the character limit of the F5, characters are trimmed from the end of the common name until an allowable length is achieved.
   Certificate & Key File		This read-only field displays the filename of the certificate associated with the current F5 LTM Application object once it is provisioned. If it has not yet been provisioned there will be no value in this field. This setting applies when Provisioning Mode is Advanced or Basic.
   Private Key Credential		The password that encrypts the private key.
   Force Profile Update		Used to handle situations where the password has changed between generations of the certificate. When set to No—which is the default setting—then Trust Protection Foundation displays an error stating that provisioning could not be done because the password has changed since the last time it was provisioned. When set to Yes, then Trust Protection Foundation continues with provisioning; however, there will be a brief service interruption during provisioning.
   Install Chain		Option to install the chain on the F5 LTM application.
   Bundle Certificates		Option to bundle the root and intermediate root certificates with the certificate file installed on the current BIG-IP F5 LTM appliance.
   Overwrite Chain File		Overwrites the existing certificate chain file when it provisions a certificate on the BIG-IP F5 LTM appliance. If you do not select this option, Trust Protection Foundation cannot provision certificates if there is an existing certificate on this network appliance.
   CA Chain File		Filename of the chain file associated with the current BIG-IP F5 LTM Application object.
   Key Security Type		Creates the certificate and private key in accordance with the Federal Information Processing Standard (FIPS) or stored on an external HSM (NetHSM). This setting ensures the certificate that is installed on the current BIG-IP F5 LTM appliance meets FIPS requirements or the private key is created and stored on an external HSM (the associated certificate must set "Generate Key/CSR on Application" to "Yes"). On the F5, FIPS and NetHSM require configuration. See the F5 documentation. NOTE  Advanced Key Protect must be Enabled to use the NetHSM (external HSM) option.
   Overwrite Certificate and Key		Overwrites the existing certificate and key file when it provisions a certificate and non-encrypted private key on the BIG-IP F5 LTM appliance.
   Delete Previous Cert and Key		This option allows you to choose if you want to attempt to delete the previous certificate and key if they exists and if they are not associated with another SSL profile on the F5 LTM application.
   High Availability Settings		The following settings let you configure options for F5 LTM applications running in high availability (HA) pairs or clusters. DID YOU KNOW?  These options provide a work-around to the more common (and often recommended) floating IP configuration for F5s running in HA mode. If using a Floating IP is not an option, then these HA options can help you to provision your F5s that are configured for failover.
   Provisioning To		Palo Alto Networks recommends that you provision to the floating management IP of the F5 Big-IP, in which case you'll always be provisioning to an active node. However, if for some reason you can't (or choose not to) provision to the floating IP, then you must provision directly to each appliance. In this case, you'll need to decide if you want Trust Protection Foundation to update the Active node, Standby node, or both (Ignore Failover State). You can select between Standalone, Active, Standby or Ignore modes. Standalone: use when you have only one server. Active: use when you want Trust Protection Foundation to provision only to active F5 appliances. Standby: use when you want Trust Protection Foundation to provision only to F5 appliances that are in stand by mode. Ignore: use when you want Trust Protection Foundation to provision to F5 appliances regardless of whether or not they're in active or stand-by modes. When selected, the Ignore option bypasses logic in the provisioning steps where Trust Protection Foundation checks the state of the F5 Big IP node it's provisioning to where there is a pair or cluster. This meets a use-case where the F5 Big IP LTM pair or cluster is not configured with a floating IP address and you do not want the state to be checked or considered when provisioning the certificate to the defined host because it may change over time. Keep the following in mind when considering provisioning directly to each F5 appliance: Provisioning directly requires twice the number of F5 application objects: one set for the first appliance and a duplicate set for the second. If you choose Active or Standby, then provisioning to half of those F5 apps is going to fail because the appliance isn't in the HA state required for Trust Protection Foundation to provision to it; this also means that after provisioning is complete, you'll have to perform additional work to clear errors. TIP  You can automate the additional work using Adaptable Log Channel or Adaptable Workflow. If you choose Ignore Failover State, then both appliances are updated; however, about half of the work that the F5 driver does will be lost; this is because the Config Sync will overwrite the updates made to the target of the sync.
   Config Sync		This option allows you to choose the if you would like the driver to execute a config synchronization after the certificate and key is installed on the F5 LTM application running in HA mode.
   SSL Profile Settings	The following settings allow you to configure the SSL Profile name, type, parent profile, virtual server and partition with which the certificate will be associated on the F5 LTM application.
   SSL Profile	NA	Specify the name of the F5 LTM SSL Profile you wish to create (if it does not exists) or with which to associate the certificate.
   SSL Profile Type		Use to select the F5 LTM profile type: Server or Client.
   Parent SSL Profile		Specify the name of the F5 LTM Parent SSL Profile that the SSL Profile will use to inherit its settings from. If no value is specified here, the F5 LTM Default SSL Profile is used.
   SSL Partition		Specify the name of the F5 LTM Partition that the Certificate and SSL Profile will be installed in. If no value is specified, the default partition is used.
   SNI Server Name		Type the name of the SNI server to enable provisioning of certificates that are being used in SNI configurations. This field is enabled when you specify either Client or Server as the SSL Profile Type. When provisioning, the SNI Server Name is automatically updated to match the settings of the actual SSL Profile on the F5 if the profile already exists.
   SNI Default		When set, this SSL profile is used as the default profile when there is no match for the server name, or when the client does not support or use SNI. This setting is available for both Client and Server SSL profiles. DID YOU KNOW?   You can configure SNI Server Name and SNI Default for both Client and Server SSL profiles on F5 devices—not just client profiles. This means you can use SNI for both inbound and outbound SSL/TLS connections managed by your F5. Suppose you have one F5 virtual server hosting multiple websites, all resolving to the same IP address. You want each site to present its own SSL certificate. Before SNI, you had to: Run each site on a different port (e.g., https://site1.net:443, https://site2.net:8080), which is inconvenient for users. Assign a dedicated IP address to each site, which is inefficient and costly. Use a single certificate for all sites, which leads to browser warnings for domain mismatches. SNI (Server Name Indication) solves these problems by allowing the F5 to present the correct certificate based on the hostname requested by the client—even when multiple SSL profiles are associated with a single virtual server. With support for both client and server SSL profiles: You can specify the SNI Server Name for any SSL profile type, ensuring the right certificate is presented for each hostname. The SNI Default option lets you designate a fallback profile for connections that don’t specify a hostname or don’t support SNI. This expanded support gives you greater flexibility and security for complex, multi-site environments—whether you’re managing inbound client connections or outbound server connections.
   SSL Profile Association		The following settings require information to associate a server SSL profile to an F5 monitor or an existing virtual server.
   Associate SSL Profile To		Determines what Trust Protection Foundation binds the SSL profile to after it provisions the certificate. You can select between Virtual Server, Monitor, or No Associations. Virtual Server: Trust Protection Foundation binds the SSL profile to every virtual server you list in Virtual Servers, on every renewal. Always set up your virtual servers on the F5 before you create the application, then list them. IMPORTANT  If you select Virtual Server and leave Virtual Servers empty, provisioning fails with error 0x401A0090 before Trust Protection Foundation contacts the device. Either add the virtual servers that the certificate serves, or select No Associations. Monitor: Trust Protection Foundation associates the SSL profile with the F5 monitor you name in Monitor. This option applies to server SSL profiles only: you cannot associate a profile whose SSL Profile Type is Client with a monitor. Associating a monitor to an SSL profile works only on BIG-IP versions later than 13.1.0. The F5 monitor type must be https or http2. http2 monitors supported are from versions V15.1 or greater. No Associations: Trust Protection Foundation installs and renews the certificate on the SSL profile but never adds or removes virtual server bindings. This is the setting to use when Trust Protection Foundation manages the certificate and your F5 team manages the bindings. For how each option fits a given F5 operating model, see Choosing how Trust Protection Foundation associates the SSL profile.
   Virtual Servers		This field only applies when Virtual Server is selected in Associate SSL Profile To. Neither WebAdmin nor Aperture stops you from saving it empty, but provisioning fails if you do, so treat it as required. List every existing F5 LTM virtual server that shares this certificate, one per line. All of the virtual servers you list share a single certificate, a single private key, and the one SSL profile named in SSL Profile, so the certificate is enrolled and the key generated only once no matter how many virtual servers are in the list. Give each virtual server as its full F5 path, which includes its partition: /Common/vip01. A virtual server in a folder below the partition uses the full path to the folder as well: /Common/sales/vip01. Because the partition is part of the path, there is no separate virtual server partition field. NOTE  If a virtual server in the list is not on the device, Trust Protection Foundation warns about it, provisions the rest, and leaves it in the list so that it binds on the next renewal without anyone editing the application. Provisioning fails only when none of the virtual servers in the list are found on the device.
   Monitor		This field only applies when Monitor is selected to associated the SSL profile to. Specify the name of the monitor that the SSL profile with be associated with . This is a required field.
   Monitor Partition		This field only applies when Monitor is selected to associated the SSL profile to. (Optional) Specify the monitor partition. If no value is specified, the common partition will be used.
   Advanced Settings		The following settings allow you to configure advanced settings for the SSL profile related to Mutual Authentication and truststore bundle provisioning.
   Use Advanced Settings		This field and all of the others (except the last two display fields) can be controlled with policy. This checkbox turns on or off all the fields in the Advanced Settings section. If you are not using Mutual Authentication on your F5 LTMs, it can help the driver to be less complicated for your Trust Protection Foundation users who are setting up F5 Big IP LTM application.
   Client Certificate		This field is only available if you choose 'Client' in the SSL Profile Type field in the SSL section in the F5 LTM Advanced driver settings. For a Client SSL Profile type the choices are "ignore", "require", "request" or "auto". This setting specifies the way the system handles client certificates. The default is Ignore. Ignore: Specifies that the system ignores certificates from client systems. Server & Client Profiles Require: Specifies that the system requires a client to present a valid certificate. Server & Client Profile Auto: Specifies that the system ignores a client certificate until an authentication module requests one. Client Only Request: Specifies that the system requests a valid certificate from a client but always authenticate the client. Client Only
   Server Certificate		This field is only available if you choose 'Server' in the SSL Profile Type field in the SSL section in the F5 LTM Advanced driver settings. For a Server SSL Profile type, the choices in this drop-down are "ignore" or "require", Ignore: Specifies that the system ignores certificates from client systems. Server & Client Profiles Require: Specifies that the system requires a client to present a valid certificate. Server & Client Profile
   Frequency		For both Server and Client SSL Profiles, the choices here are "Once" or "Always". This value defines the frequency of client authentication for an SSL session. The default is Once, which specifies that the system authenticates the client once for an SSL session. Always specifies that the system authenticates the client once for an SSL session and also upon reuse of that session.
   Chain Traversal Depth		You can choose a number from 1 to 9, with 9 being the default depth value. Specifies the maximum number of certificates to be traversed in a client certificate chain.
   Certificate Bundle		This field lets you select an F5 Authentication bundle for one or more certificates that will be provisioned to the F5 and associated with the profile as the authentication bundle used for mutual authentication. Click to make your selection from the Policy tree. If there are no bundles listed, you must first create one. For more information about creating an authentication bundle, see About managing an F5 authentication bundle.
   Authentication Name		This field only applies to Server SSL Profiles and will not be selectable when a Client SSL Profile type if selected. This field specifies a Common Name (CN) that is embedded in a server certificate. The system authenticates a server based on the specified CN. The CN name must be a valid fully qualified domain name (FQDN), and hence the authenticate name specified must also be a FQDN. Note that the Domain Name System (DNS) does not allow the underscore ( _) character in CN names, although it does allow the dash ( -) character. IMPORTANT  If you select Require in Server Certificate, make sure to specify a value in Authenticate Name as well. A blank Authenticate Name field means that everyone is authenticated, even though you have specified Require as the Server Certificate setting.
   Trusted CA File		This field is for display purposes only, as Trust Protection Foundation controls the name of the certificate file and truststore bundle file. For a Server SSL Profile this could be a single self-signed certificate or one or more certificates in a truststore bundle.
   Advertised CA File		This field is for display purposes only and only applies to Server SSL Profile types.

8. When you are finished, click Save.

Choosing how Trust Protection Foundation associates the SSL profile

Organizations run their BIG-IP F5 LTM appliances in very different ways, and Associate SSL Profile To is the setting that tells Trust Protection Foundation which of those ways yours follows. The sections below describe the operating models the three options support, and why each one is set up the way it is.

Trust Protection Foundation manages the bindings

Set Associate SSL Profile To to Virtual Server and list one or more virtual servers in Virtual Servers. Trust Protection Foundation is the source of truth for the bindings during provisioning: on every renewal it binds the SSL profile to every virtual server in the list, so a binding that someone removed on the F5 between renewals is put back.

A virtual server that is on the list but not on the device does not stop the run. Trust Protection Foundation logs warning 0x401A008E for it, provisions the rest, and leaves it on the list, so it binds as soon as someone creates it on the F5. Provisioning fails with error 0x401A0067 only when none of the listed virtual servers are on the device.

Your F5 team manages the bindings

Set Associate SSL Profile To to No Associations and leave it there. Trust Protection Foundation keeps the certificate on the SSL profile current and never adds or removes a virtual server binding, so your F5 team decides which virtual servers use the profile.

Do not try to get the same result by selecting Virtual Server and leaving Virtual Servers empty. That combination is not valid, and provisioning fails.

Staging an application before the SSL profile is in use

Create the application yourself, with Associate SSL Profile To set to No Associations, before the SSL profile is attached to any virtual server. Trust Protection Foundation renews the certificate on the profile, and Disable Installations Not In Use does not retire the application, even though nothing on the device uses the profile yet.

While the application is staged, every Onboard Discovery run that has Disable Installations Not In Use turned on logs warning 0x00270033 for it. That is expected and needs no action: the event records that the run did not evaluate the application for retirement.

When the SSL profile goes live, the cleanest path is to change Associate SSL Profile To to Virtual Server yourself and list the virtual servers. Trust Protection Foundation binds them on the next provisioning run, and Onboard Discovery recognizes the application whatever it is named, because it matches an application to the SSL profile the application serves rather than to the application's name.

If your F5 team binds the profile to a virtual server before you make that change, Onboard Discovery takes over the staged application only when both of the following are true. Otherwise it creates a second application for the same SSL profile, beside the one you staged.

• The application is named exactly what Onboard Discovery would name it: the SSL profile name, plus - <partition> when the profile is in a partition other than Common.

• The application holds the same certificate that the SSL profile carries on the device.

An empty Virtual Servers list with Virtual Server is not valid

If Associate SSL Profile To is Virtual Server and Virtual Servers is empty, provisioning stops before Trust Protection Foundation contacts the device and logs error 0x401A0090. This check applies to applications that use advanced provisioning. An application set to one of the Basic provisioning modes, and an application with Device Certificate selected, are exempt from it.

To fix it, either add the virtual servers that the certificate serves, or set Associate SSL Profile To to No Associations.

An SSL profile loses its last virtual server

When no virtual server on the device is bound to the SSL profile any more, the next Onboard Discovery run of that device detaches the application. Trust Protection Foundation sets Associate SSL Profile To to No Associations, clears Virtual Servers, clears Validation Host and Validation Port, logs warning 0x00270038, and goes on renewing the certificate on the profile. Detaching the application is what stops it from binding its profile back onto a virtual server that now carries a different certificate.

If a virtual server is bound to that SSL profile again later, the next discovery run sets the application back to Virtual Server and fills Virtual Servers in again.

If the discovery job has Disable Installations Not In Use turned on, the application is retired instead of detached. Trust Protection Foundation renames it to <name> - obsolete 1 and disables it; the number goes up if that name is already taken.

None of this applies to an SSL profile that has been deleted from the F5. A profile the device no longer reports is not recorded as unbound, so the application that served it is left to the normal retirement rules.

How Disable Installations Not In Use treats each kind of application

When an Onboard Discovery job has Disable Installations Not In Use turned on, it sweeps the applications under each device it discovers and retires the ones the device no longer uses. What the sweep does depends on what the application is associated to, and on whether Trust Protection Foundation or a person created it.

Retirement eligibility by kind of application

Virtual Server	Eligible for retirement. The application is retired when the discovery run finds no SSL profile of the same name, partition, and type carrying the same certificate.
Monitor	Eligible for retirement. The application is retired when the discovery run finds no monitor of the same name and partition using the same SSL profile. The certificate is not part of the comparison.
No Associations, created by you	Never retired by the sweep. The run logs warning 0x00270033 for the application and moves on.
No Associations, set that way by Onboard Discovery	Eligible for retirement, on the same terms as a Virtual Server application. An application discovery detached still stands for its SSL profile.

Two limits apply to the sweep whatever the application is associated to:

• It considers only the SSL profile types the discovery job imports. If the job imports client profiles only, applications on server profiles are left alone, and the other way around.

• It runs only when that discovery run found at least one application on the device. A run that returns nothing, because the device was unreachable or because every profile failed to import, does not retire anything.

How Trust Protection Foundation validates an F5 LTM Advanced application

An F5 LTM Advanced application object is validated in two independent ways, and the virtual servers you list change only the first of them. For background on both, see About certificate and application validation.

Network validation

When the application lists two or more virtual servers and Use REST API is turned on, Trust Protection Foundation no longer resolves the common name of the certificate to decide what to probe. It asks the F5 management API for the destination of each virtual server in the list, takes the listener address and port from that destination, and probes every one of them. Each virtual server produces its own validation result, the whole set replaces the results of the previous scan, and the application validates only when every virtual server in it validates.

A virtual server that is in the list but not on the device, or that has no usable listener, is recorded as a failed result rather than skipped. A list that has drifted away from the device therefore shows up as a validation failure instead of quietly shrinking the scan.

When an application has no virtual servers and no Validation Host, nothing on the network is serving its certificate, so Trust Protection Foundation skips the check rather than spending a scan to discover that. It logs informational event 0x401A008C, and the application is reported as not validated rather than as a validation failure. This applies whether Associate SSL Profile To is Virtual Server or No Associations. An application with Device Certificate selected is exempt, because its certificate is served on the management address.

To have the check run on a No Associations application, set a Validation Host on it. Note that Onboard Discovery clears Validation Host and Validation Port when it detaches an application whose SSL profile has lost its last virtual server, so a host you set before that happens does not survive it.

File validation

File validation pulls the certificate file from the F5 by its file name, through the F5 management API, and compares it with the certificate Trust Protection Foundation has stored. It checks only that certificate. It does not check the SSL profile or the virtual server bindings, so a certificate file that matches passes file validation whether or not the profile that uses it is bound to the virtual servers in the list.

Troubleshooting an F5 LTM Advanced application

Renewal fails with 0x401A0090

Associate SSL Profile To is set to Virtual Server and Virtual Servers is empty. Trust Protection Foundation stops the run before it contacts the device, so nothing on the F5 changed.

Either add the virtual servers that the certificate serves, or set Associate SSL Profile To to No Associations if your F5 team manages the bindings. If the application started failing right after an upgrade to 26.2, check whether it had a virtual server partition set but no virtual server name: the migration carries nothing over from a partition on its own, so the new list is empty.

My application switched to No Associations by itself

An Onboard Discovery run found that no virtual server on the device is bound to the application's SSL profile any more, so it detached the application and logged warning 0x00270038. Trust Protection Foundation goes on renewing the certificate on the profile; it has only stopped binding the profile to virtual servers.

If the profile should still be bound, bind it to a virtual server on the F5. The next discovery run sets the application back to Virtual Server and fills Virtual Servers in again. Setting the application back by hand while the profile still has no virtual server bound to it does not hold: the next discovery run detaches it again.

Discovery logs 0x00270033 for my staged application

This is expected for an application you created with Associate SSL Profile To set to No Associations, and it needs no action. The event records that the Disable Installations Not In Use sweep did not evaluate the application, which is what keeps a staged application from being retired before its SSL profile is in use.

The same event is logged for an application whose Associate SSL Profile To value is missing or holds something Trust Protection Foundation does not recognize. If the application is not one you staged, open it and check that setting.

Validation shows the application as not validated

If the log holds informational event 0x401A008C, the application has no virtual servers and no Validation Host, so there was nothing on the network to probe. This is not a validation failure, and no scan was run.

Add the virtual servers the certificate serves, or set a Validation Host on the application if it is one your F5 team binds. Remember that Onboard Discovery clears Validation Host when it detaches an application.

What's next?

After you've created an application object, here are other things you can do to manage the new application:

• On the application's Settings sub-tab:

  • Click to push a certificate to its associated application.

    For more information, see Pushing a certificate and private key to an application .

  • Click Reset to stop processing the application and reset the status and stage.
  • Click to reattempt installation of the certificate to its associated application, .

  • Click Validate Now to validate the applications associated certificate.

    Validation requests are placed into a queue. When your validation runs, the application and its associated certificate are scanned according to the settings configured in the application object’s Validation tab.

    For more information, see About certificate and application validation.

• On the application object's Validation tab, you can configure validation settings for the application object.

• On an object's General tab:

  • Click the Log sub-tab to view any events that are triggered by the template object.

  • Click the Permissions sub-tab to configure the users or groups to whom you want to grant permissions to the new object. For more information, see Permissions overview.

Related Topics