Blindfold TLS Certificates

• From the homepage, click Multi-Cloud Network Connect.

• In the Manage section of the configuration menu, select Secrets from the options pane, and then select Secret Policies to see a list of existing policies.

• Click Add secret policy to see the new secret policy form.

• In the Metadata section,

• Enter a unique name for the secret policy.

• Optionally, set labels and description, as necessary.

• Check Allow F5XC to allow the data plane to decrypt an encrypted TLS private key.

• Enter Decrypt Cache Timeout to limit the time a decrypted secret is cached in Wingman.

Figure: Secret Policy Metadata

The Secret Policy Rules section lists all the rules for this policy.

• To add a new rule, Select Policy Rules > choose Configure link > click Add item and fill out the secret policy rule form as outlined below.

Figure: Secret Policy Metadata

• In the Metadata section:

  • Enter a unique name for the new rule.

  • Optionally, set labels and description, as necessary.

  • In the Action section, selecting Allow or Deny determines how to react to a request if all the predicates evaluate to true.

  • In the Client Selection section, specify the client(s) that will be affected by this rule:

    • Group of Clients by Name: List of client names for which the rule will apply. You can specify them using Exact Values and/or Regex Values. Click Add item and enter exact values or regular expressions for server names. Continue to click Add item to build both lists.

    • Group of Clients by Label Selector: Specifies the labels associated with the clients to which the rule will apply. To add labels, click in the Selector Expression field, and then for each label you want to add:

    • Select a key from the displayed options or type a key and click Assign Custom Key,

    • Select a displayed operator,

    • Select a displayed value or enter a custom value,

    • Click Apply. If this is the last label, click outside the Selector Expression area or press the tab key.

  • Client Name: Enter a single client name.

• When finished entering clients for this rule, click Apply.

Figure: Secret Policy Action

• Click Apply to save the custom rule list.

• Click Save and Exit to complete the secret policy.

Figure: Secret Policy Metadata

• Log into F5 Distributed Cloud.

• Create an API certificate using the instructions in the Credentials guide.

• Download the certificate in the PKCS #12 (P12) format.

Create a file named .vesconfig and add the P12 certificate bundle and the tenant server URLs to that file.

Enter the following command:

export VES_P12_PASSWORD=<p12 password>

Note: The password for the P12 file is set during the generation of API certificate.

This example stores the output to a file named demo-api-pubkey.

vesctl request secrets get-public-key > demo-api-pubkey

This example stores the output to a file named demo-api-policy. You can use the in-built policy or the policy created in the previous section. This example uses the in-built ves-io-allow-volterra policy.

vesctl request secrets get-policy-document --namespace shared --name ves-io-allow-volterra > demo-api-policy

This example stores the output to a file named bl-enckey.

vesctl request secrets encrypt --policy-document demo-api-policy --public-key demo-api-pubkey key.pem  > bl-enckey

Note: Provide the public key and policy document obtained in the Prepare Credentials and Policy section. The key.pem is the TLS key to be encrypted.

You will need the encrypted key in the Enable TLS on the Virtual Host section when adding your TLS key.

• Log into Console.

• Click Web App & API Protection.

Figure: Console Homepage

• Select your namespace from the Namespace drop-down menu.

• Select Manage > Load Balancers > HTTP Load Balancers.

• Select ... > Manage Configuration for your load balancer, and then select Edit Configuration in the top right to edit the load balancer's configuration.

Figure: Custom TLS

• Select HTTPS with Custom Certificate from the Load Balancer Type drop-down menu in the Domains and LB Type section.

• Optionally select HTTP Redirect to HTTPS and Add HSTS Header checkboxes.

• Use the HTTP Listen Port Choice to select between using a single port or a range of ports, and then enter the port number(s). For a range of ports, enter a list of non-overlapping port ranges with a maximum of 64 ports in the list, e.g. 443,100-120,8080,9080-9089.

• Select TLS Certificates from the TLS Configuration drop-down menu, and then click Configure.

• From the TLS Security Level drop-down menu, select the desired level.

• From the Certificates drop-down menu, select Add Item. This brings up the TLS Certificate form allowing you to add import a certificate. Typically, you would use Import from File, but this example will show how to paste a certificate instead.

Figure: import TLS Certificate

• Click the JSON tab above the form. This will show your TLS certificate and associated information in a JSON editor. It will be empty, except for any metadata you may have entered in the form.

Figure: Empty TLS Certificate JSON

• Add your certificate and private key to the JSON using one of the following instruction sets based on the type of certificate/key you want to enter.

{
  "metadata": {
    "name": "certificate-name",
    "namespace": "my-namespace"
  },
  "spec": {
    "disable_ocsp_stapling": {},
    "certificate_url": "string:///<base64 encoded certificate>",
    "private_key": {
      "clear_secret_info": {
        "url": "string:///<base64 encoded private key>"
      }
    }
  }
}

{
    "metadata": {
        "name": "certificate-name",
        "namespace": "my-namespace"
    },
    "spec": {
        "disable_ocsp_stapling": {},
        "certificate_url": "string:///<blindfolded certificate>",
        "private_key": {
            "blindfold_secret_info": {
                "location": "string:///<blindfolded private key>"
            }
        }
    }
}

• Once your certificate and key are in the spec section, ensure that the name and namespace values are correct in the metadata section. The namespace value must match your selected namespace.

• Click the Form tab to return to the TLS Certificate form.

Figure: TLS Certificate Added

• Select an OCSP Stapling option. Then click Continue to save the certificate.

• Click Save and Exit to create your certificate.

• Your new certificate will now be in your certificates list. Make sure it is selected in the Certificates drop-down menu and then click Apply to save your TLS parameters.

• In the TLS Parameters form, you can use Add Item to add more TLS certificates, if required.

• Click Apply to save your TLS parameters.

• Click Save and Exit to complete the modifications to your HTTP load balancer.