Blindfold your TLS Certificates

• From the Home screen, click Cloud and Edge Sites under All Services.

• In the Manage section of the configuration menu, select Secrets from the options pane, and then select Secret Policies to see a list of existing policies. Then click Add secret policy to see the new secret policy form.

• In the Metadata section,

• Enter a unique name for the secret policy.

• Optionally, set labels and description, as necessary.

• Check Allow F5XC to allow the data plane to decrypt an encrypted TLS private key.

• Enter Decrypt Cache Timeout to limit the time a decrypted secret is cached in Wingman.

The Secret Policy Rules section lists all the rules for this policy.

To add a new rule, Select Policy Rules > choose Configure link > click + Add item button and fill out the secret policy rule form as outlined below.

In the Metadata section,

• Enter a unique name for the new rule.

• Optionally, set labels and description, as necessary.

In the Action section, selecting Allow or Deny determines how to react to a request if all the predicates evaluate to true.

In the Client Selection section, specify the client(s) that will be affected by this rule.

• Group of Clients by Name - List of client names for which the rule will apply. You can specify them using Exact Values and/or Regex Values. Click Add item and enter exact values or regular expressions for server names. Continue to click either Add item button to build your list.

• Group of Clients by Label Selector - Specifies the labels associated with the clients to which the rule will apply. To add labels, click in the Selector Expression field, and then for each label you want to add:

  • Select a key from the displayed options or type a key and click Assign Custom Key,
  • Select a displayed operator,
  • Select a displayed value or enter a custom value,
  • Click Apply. If this is the last label, click outside the Selector Expression area or press the tab key.

• Client Name: Enter a single client name.

When finished entering clients for this rule, click Save and Exit button.

• Click Save and Exit button to complete the secret policy.

  

• Log into F5 Distributed Cloud Platform
• Create an API certificate using the instructions in the Generate API Certificate chapter of the Credentials document.
• Download the certificate in the PKCS #12 (P12) format.

Create a file named .vesconfig and add the P12 certificate bundle and the tenant server URLs to that file.

Enter the following command:

export VES_P12_PASSWORD=<p12 password>

Note: The password for the P12 file is set during the generation of API certificate.

This example stores the output to a file named demo-api-pubkey.

vesctl request secrets get-public-key > demo-api-pubkey

This example stores the output to a file named demo-api-policy. You can use the inbuilt policy or the policy created in the previous chapter. This example uses the inbuilt ves-io-allow-volterra policy.

vesctl request secrets get-policy-document --namespace shared --name ves-io-allow-volterra > demo-api-policy

This example stores the output to a file named bl-enckey.

vesctl request secrets encrypt --policy-document demo-api-policy --public-key demo-api-pubkey key.pem  > bl-enckey

Note: Provide the public key and policy document obtained in the Prepare Credentials and Policy chapter. The key.pem is the TLS key to be encrypted.

You will need the encrypted key in the Enable TLS on the Virtual Host chapter when adding your TLS key.

• Select Manage from the configuration menu and Virtual Host -> Virtual Hosts from the options pane.
• Choose your virtual host from the list displayed and open virtual host edit form.

Scroll to the TLS parameters and click Configure to load the for TLS parameters configuration form.

• Click Configure to see the TLS common parameters form.

  

• In the TLS Certificates section, select an certificate from the list.

  • Or click Add Item to create a new TLS certificate.

    

  • Paste the certificate or certificate chain into the Certificate URL field. The certificate/chain should be in PEM format including the PEM headers.

  • In the Private Key section, click Configure and select Blindfold Secret. Enter the encrypted string in the Type field. Use the string obtained in the Encrypt TLS Key Using Blindfold chapter. Then click the Apply button to return to the Common Parameters form.

  • Optionally enter a description in the Description section.

  • In the OCSP Stapling choice section, choose to enable or disable OCSP stapling.

  • Click Add Item to return to the Common Parameters form.

• In the Trusted CA Validation params section, click Configure.

  

• In the Trusted CA field, enter the URL for a trust store.

• Check Skip verification of hostname to not check if the certificate matches the connecting hostname.

• In the List of SANs for matching section, click Add item for the Subject Alternative Name (SAN), and then enter the alternate name in the Enter verify subject alt names field.

• Click the Apply button to return to the Common Parameters form.

• Enter the minimum and maximum TLS versions in the two respective fields, or select Automatic to let Distributed Cloud App Stack choose the optimal versions.

• Choose the cipher suite(s) for your certificates.

  • In the Cipher Suites section, click Add item for each suite, and select the specific suite from the dropdown list.
  • Click the Apply button to return to TLS Parameters form.

• Check the box Require Client Certificate (enable TLS) if you want to reject connections without a valid client certificate.
• Click the Apply button to finish the TLS parameters.