F5 BIG-IP¶
PKIFactor delivers, renews and verifies certificates on F5 BIG-IP through its iControl API: REST for most operations, SOAP where REST has no equivalent (inline key import without the administrator-only file transfer, reading the public key of the served certificate, reading back a CSR generated on the device). It covers the three TLS roles of a BIG-IP: client-ssl (inbound), server-ssl (outbound mTLS) and the SSL forward-proxy inspection CA.
Read How deployment works first for the vocabulary and the safety rules.
Prerequisites on the F5¶
| Item | Recommended value |
|---|---|
| Service account | Dedicated user, for example svc-pkifactor, local or remote authentication. A new local account must change its password once, otherwise the login returns "Password expired". |
| Role | Resource Administrator, never Administrator. With the option Install crypto via SOAP (on by default) it covers the full cycle. |
| Partitions | The partitions holding the SSL profiles to manage. resource-admin is all-partitions by design on BIG-IP: for strict scoping, create a custom role (crypto and LTM permissions) scoped to the partition, or rely on PKIFactor's list of managed partitions. The connection test flags an account broader than the partition it writes to. |
| Access | iControl REST (mandatory) and SOAP on the management port (443), from the PKIFactor host (backend and worker) to the management address of each BIG-IP. |
| Version | Tested on BIG-IP VE 17.5. Generating the CSR on the device over REST needs TMOS 14.1 or later. |
| FIPS / netHSM | The FIPS or external HSM module must be licensed and active (an evaluation license may list the module and still refuse key generation). |
| TLS | A valid management certificate; a private CA can be provided as PEM through the API (ca_cert). |
| High availability | Nothing to configure: the pair is detected by the connection test. See F5 clusters. |
Declare the F5¶
Administration > Operations > Endpoints, Add a target:
- Identity: name, description, Connector type F5 BIG-IP.
- Connection: Host (management IP or FQDN, port in the host if not 443), Service account, Password (encrypted at rest, never shown again), Verify the management TLS certificate.
- Test & detect partitions: checks the access and lists the partitions the account sees. Choose the Default creation partition and tick the Partitions managed by this endpoint (empty means all).
- Installation options:
- Install crypto via SOAP (least-privilege, no Administrator), on by default. When off, the private key is never sent through the file transfer (which would leave it on the device's disk), and bindings with a pushed key are refused.
- Resolve the served cert's SPKI (SOAP): adds the public key to the drift check; recommended with device key reuse.
- Follow the ACTIVE unit of the HA pair (on by default) and Allow writes on a STANDBY unit (lab only): see F5 clusters.
- On-device key custody: Normal (software key, default), FIPS (on-board HSM) or netHSM (external HSM through PKCS#11, with its netHSM partition).
- Owner team and defaults: contact name and e-mail (they receive the daily digest of planned deployments, with the veto window), Default lead time (days before expiry), default Automation level.
Then Create endpoint, and Test connection on the endpoint page. The result shows the TMOS version, whether CSR generation on the device is available, the HA role and synchronization state, and two notes when relevant: the account is broader than needed, or it cannot read AS3 declarations (AS3-managed profiles would then not be recognized as such).
Editing an endpoint keeps a password left empty unchanged. If the hourly check gets no answer, the page says Endpoint unreachable at last check and no automatic action runs until it answers again; certificates already served stay in place.
Deploy a certificate¶
From the endpoint page (Add a binding) or from estate discovery (Create binding on a served object), the form Link a certificate:
| Field | Purpose |
|---|---|
| Certificate source | Existing certificate, or Issue from a template with the CN to issue (the profile decides the authority) |
| Certificate role | Server certificate — presented to inbound clients (client-ssl, default), Client certificate — outbound mTLS to a backend (server-ssl), forward-proxy-ca — outbound TLS inspection CA |
| Virtual server, Profile (server certificate) | Where the certificate is served. The profile list follows the role chosen (client-ssl or server-ssl profiles read from the F5) |
| Key custody | Key born on the appliance / netHSM — it never leaves it, or Key generated by PKIFactor and pushed to the appliance |
| Automation | Full auto, Install, Provide only, ACME (advanced, asks for a confirmation) |
| On-device key algorithm, Reuse the device key on renewal, Renew (days before expiry), Intervention date (UTC, optional) | Fine tuning (below) |
The F5 keeps two fields (virtual server and profile), because a profile can be shared by several virtual servers. Edit binding on the binding page changes the certificate, the profile, the custody, the key algorithm and the threshold; the automation level and the schedule are changed on the binding page itself.
Install with a pushed key installs the renewed certificate but leaves the profile on the previous object (staged); a person reviews and clicks Activate (switch over). With the key on the device, Install means manual provisioning (Provision on appliance).
At the end of each change PKIFactor saves the configuration (save sys config). A configuration not saved alert means the change could be lost at the next reboot: run the operation again.
Verification and drift¶
After the switch over, and then every hour, PKIFactor reads what each profile serves (serial number, and public key when the SOAP option is on) and sets the binding status: verified, staged, drift, error.
A binding in drift is held: an out-of-band change is never overwritten. The operator checks, then Reconcile (realign the tracking on the certificate actually served, if it came from PKIFactor), deploys again, or Adopt (reclaim) to take over.
A certificate created outside the standard management channel may not be exportable through the API: PKIFactor reports it as unreadable rather than guessing, and matches it by serial number.
What PKIFactor does at D-X¶
| Automation | Key pushed | Key on the device |
|---|---|---|
| Full auto | Renews, installs and switches over (hitless rotation) | The device generates key and CSR, PKIFactor has it signed and provisions it: the provisioning is the go-live |
| Install | Renews and stages; a person activates | Nothing scheduled: provisioning is manual |
| ACME | The F5 renews itself with its ACME client; PKIFactor supervises | |
| Provide only | The certificate is made available (Make available), nothing is written | not applicable |
| Custody | Where the private key lives | Who writes to the F5 |
|---|---|---|
| Key pushed | PKIFactor, then the F5 keystore; PKIFactor keeps an encrypted copy | PKIFactor (inline SOAP import) |
| Key on the device | On the F5 (keystore, FIPS or netHSM), never in PKIFactor | PKIFactor installs the signed certificate only |
| ACME | On the F5 | The F5 itself |
Operator actions on a binding¶
| Action | Effect |
|---|---|
| Deploy now | Reinstalls the certificate currently assigned, without a new issuance (after an incident, a new HA member) |
| Renew + deploy now | Forces a renewal outside D-X and deploys it; overrides the failure memory, never the safety checks |
| Hitless rotate | Key pushed, key kept by PKIFactor, after a first deployment |
| Provision on appliance | Key on the device: first provisioning, or rotation with a new device key |
| Reconcile, Adopt (reclaim) | See drift above |
| Make available | Provide only: records the certificate as available, writes nothing |
| Pause… / Resume | Human veto, reason mandatory |
The interface only offers the actions the device would accept.
Schedule: an intervention date (UTC) programs a one-shot renewal and deployment, independent of D-X and of the maintenance hour. The page shows the planned renewal date and the planned go-live date, and flags a threshold that cannot be met (threshold plus authority latency longer than the certificate's lifetime).
Failure memory: after an automatic failure the binding is Failed and retried after 1 h, 2 h, 4 h, up to 24 h. A renewed certificate already issued is deployed again, never issued again. A cycle stuck for more than 24 hours is restored and the owner team is alerted.
Estate onboarding¶
When you take over an F5 already in production, Discover estate lists what it serves (virtual server, profile, certificate), with a filter on virtual server, profile and CN. By CA opens Onboarding by CA, which groups it by issuing authority:
| Bucket | Action |
|---|---|
| Managed CA (one of yours, verified by signature) | Adopt all: same authority, PKIFactor takes over renewal |
| External CA, unverified CA | Reissue all from a profile (authority change) |
| Self-signed | Reissue |
| Unreadable | Look at it manually |
Every bulk action runs as a dry run first. Attach all matches served certificates with those PKIFactor already issued (serial number, then public key) and takes over their renewal without reissuing. The summary highlights the certificates served in production that nobody renews and that expire soon: start there.
Key on the device, FIPS and netHSM¶
With FIPS or netHSM custody on the endpoint, the private key is not exportable and bindings must use key on the device. The HSM brand is outside PKIFactor's scope: PKIFactor asks the F5 for a key of that custody, and the F5's own external HSM configuration names the HSM and its PKCS#11 library. Once the F5 talks to its HSM, issuance is identical for the operator.
Reuse the device key on renewal (opt-in) re-signs the same key: the public key does not change (pinning, mTLS peers) and no extra HSM slot is consumed.
server-ssl and inspection¶
| Role | Direction | Certificate managed |
|---|---|---|
| client-ssl | Inbound, the F5 is the TLS server | The server certificate presented to clients |
| server-ssl | Outbound, the F5 is the TLS client | The client certificate presented to back ends for outbound mTLS (clientAuth), plus a read-only inventory of the trust anchors |
| forward-proxy-ca | Outbound inspection | The inspection CA the F5 signs forged certificates with |
- server-ssl: the certificate must carry the clientAuth usage; the key must be on the F5. Public authorities are leaving client certificates: these identities move to private PKI. The trust anchors the profile accepts are listed and graded (expired, expiring within 90 days, weak key); changing them stays on the F5.
- forward-proxy-ca: the certificate must be a CA (
basicConstraints CA:TRUE); a leaf is refused. PKIFactor installs the CA entry while preserving the profile's server entry and rotates it without interruption. Renewing an inspection CA is a trust event: the new CA must be distributed to client devices (GPO, MDM) alongside the rotation.
Safety rules specific to F5¶
- A new client-ssl profile serves the built-in placeholder
/Common/default.crt: PKIFactor recognizes it and lets the first deployment proceed. - A profile shared by several virtual servers, shared through SNI, or inherited by other profiles downgrades automation to staged, approval required.
- If the certificate object is also referenced by profiles PKIFactor does not manage, the deployment is downgraded to approval and the profiles are named. After a renewal, the previous object is kept as long as another profile uses it, and the alert previous certificate still served names that profile (owner, SIEM, and a high-priority ServiceNow incident when configured).
- Objects with the same name in different partitions are never confused: names are always compared with their partition.
- Configuration owned by AS3 or an iApp is refused with the reason.
- Adopt (reclaim) (administrator, audited, one-shot) lifts only the protection of an incumbent certificate; FIPS/HSM, permission, IaC and standby restrictions stay in force.
- Moving a binding to key pushed schedules a re-key: the next renewal creates a key held by PKIFactor instead of reusing the device CSR (Re-key scheduled badge).
Advanced settings¶
| Setting | Effect |
|---|---|
| Key algorithm on the device | RSA-2048/3072/4096, ECC-P256/P384/P521; checked against the profile's allowed algorithms |
| Anchored profile | Lets an imported certificate without profile be renewed |
| Notice recipients | Subscribers (e-mail, webhook, SFTP) warned before a renewal, for example mTLS peers with pinned trust stores; they can ask for a veto |
| Maintenance hour | A due renewal waits for that hour, except within 2 days of expiry and except an explicit intervention date |
| Authentication provider | login_provider (API): tmos for a local account, or the remote provider configured on the F5 |
Every action (deploy, activate, provision, adopt, pause with its reason, edits) is recorded in the audit trail and forwarded to the SIEM.