Blindfold your TLS Certificates

• From the Home screen, click Cloud and Edge Sites under All Services.

• In the Manage section of the configuration menu, select Secrets from the options pane, and then select Secret Policies to see a list of existing policies. Then click Add secret policy to see the new secret policy form.

• In the Metadata section,

  

  • Enter a unique name for the secret policy.
  • Optionally, set labels and description, as necessary.

The Secret Policy Rules section lists all the rules for this policy. To add a new rule, click Add item and fill out the secret policy rule form as outlined below.

In the Metadata section,

• Enter a unique name for the new rule.
• Optionally, set labels and description, as necessary.

In the Action section, selecting Allow or Deny determines how to react to a request if all the predicates evaluate to true.

In the Client Selection section, specify the client(s) that will be affected by this rule.

• Group of Clients by Name - List of client names for which the rule will apply. You can specify them using Exact Values and/or Regex Values. Click Add item and enter exact values or regular expressions for server names. Continue to click either Add item button to build your list.

• Group of Clients by Label Selector - Specifies the labels associated with the clients to which the rule will apply. To add labels, click in the Selector Expression field, and then for each label you want to add:

  • Select a key from the displayed options or type a key and click Assign Custom Key,
  • Select a displayed operator,
  • Select a displayed value or enter a custom value,
  • Click Apply. If this is the last label, click outside the Selector Expression area or press the tab key.

• Client Name: Enter a single client name.

When finished entering clients for this rule, click Save and Exit.

Check Allow Volterra to allow the data plane to decrypt an encrypted TLS private key. Then enter the Decrypt Cache Timeout to limit the time a decrypted secret is cached in Wingman.

Click Save and Exit to complete the secret policy.

• Log into F5 Distributed Cloud Platform
• Create an API certificate using the instructions in the Generate API Certificate chapter of the Credentials document.
• Download the certificate in the PKCS #12 format.

This example shows how to derive the certificate using OpenSSL.

openssl pkcs12 -nokeys -in demo-api-credentials.p12 -out demo-api.crt

Note: This step prompts for password. Enter the password used in Step 1 to generate the certificate file in the .crt file.

Enter the following command:

openssl pkcs12 -nocerts -nodes -in demo-api-credentials.p12 -out demo-api.key

Note: This step prompts for password. Enter the password used in Step 1 and a passphrase to generate the key file in the .key format.

This example stores the output to a file named demo-api-pubkey.

vesctl --cert file:///demo-api.crt --key file:///demo-api.key -u https://demo-api.console.ves.volterra.io/api request secrets get-public-key > demo-api-pubkey

Note: For the --cert and --key options, specify the path to the certificate file and key file derived in Step 3 and Step 4 respectively.

The following output capture shows a sample public key:

data:
  keyVersion: 1
  modulusBase64:   rc3DxZa69sWeIn9NRrHGcZlZaXLHWYjc57jIS76Z47AcU0jDmodz3lNEysVO2swNAUn8p6yiuvf8Vj4LUuWB++LdP2yYX5ftEHmMgnHVq4AdKFBp5zbrh15g7mS0lpdX/xG6h0+IdHyrWPoIg/hZwYyV9xmIOcFc1Jk5PZC554hchHbToQ==
  publicExponentBase64: A6ur/Xk=
  tenant: volterra-demo1

This example stores the output to a file named demo-api-policy.

vesctl --cert file:///demo-api.crt --key file:///demo-api.key -u https://demo-api.console.ves.volterra.io/api request secrets get-policy-document --namespace system --name demo-api-https-policy > demo-api-policy

Note: For the --cert and --key options, specify the path to the certificate file and key file derived in Step 3 and Step 4 respectively. For the --name field, enter the API credentials object name.

The following output capture shows a sample policy document.

data:
  policyId: "104"
  policyInfo:
    rules: []
  tenant: volterra-demo1

This string is used to associate the certificate with the virtual host.

openssl base64 -in <certificate>

Note: The <certificate> can be your certificate with intermediate if required.

This example stores the output to a file named bl-enckey.

vesctl --cert file:///demo-api.crt --key file:///demo-api.key -u https://demo-api.console.ves.volterra.io/api request secrets encrypt --policy-document demo-api-policy --public-key demo-api-pubkey privkey.pem > bl-enckey

Note: Provide the certificate, key, public key, and policy document obtained in the Prepare Credentials and Policy chapter.

The following output capture shows a sample encrypted key.

sample-output:

Encrypted Secret (Base64 encoded):
AAAACWN1c3RvbWVyMQAAAAEAAAAAAAAAaAIAAAAFA6ur/XkAAAEArc3DxZa69sWeIn9NRrHGcZlZaXLHWYjc57jIS76Z47AcU0jDmodz3lNEysVO2s

You will need the encrypted key in the Enable TLS on the Virtual Host chapter when adding your TLS key.

• Select Manage from the configuration menu and Virtual Host -> Virtual Hosts from the options pane.
• Choose your virtual host from the list displayed and open virtual host edit form.

Scroll to the TLS parameters and click Configure to load the for TLS parameters configuration form.

• Click Configure to see the TLS common parameters form.

  

• In the TLS Certificates section, select an certificate from the list.

  • Or click Add Item to create a new TLS certificate.

    

  • Paste the certificate or certificate chain into the Certificate URL field. The certificate/chain should be in PEM format including the PEM headers.

  • In the Private Key section, click Configure and select Blindfold Secret. Enter the encrypted string in the Type field. Use the string obtained in the Encrypt TLS Key Using Blindfold chapter. Then click the Apply button to return to the Common Parameters form.

  • Optionally enter a description in the Description section.

  • In the OCSP Stapling choice section, choose to enable or disable OCSP stapling.

  • Click Add Item to return to the Common Parameters form.

• In the Trusted CA Validation params section, click Configure.

  

• In the Trusted CA field, enter the URL for a trust store.

• Check Skip verification of hostname to not check if the certificate matches the connecting hostname.

• In the List of SANs for matching section, click Add item for the Subject Alternative Name (SAN), and then enter the alternate name in the Enter verify subject alt names field.

• Click the Apply button to return to the Common Parameters form.

• Enter the minimum and maximum TLS versions in the two respective fields, or select Automatic to let Distributed Cloud App Stack choose the optimal versions.

• Choose the cipher suite(s) for your certificates.

  • In the Cipher Suites section, click Add item for each suite, and select the specific suite from the dropdown list.
  • Click the Apply button to return to TLS Parameters form.

• Check the box Require Client Certificate (enable TLS) if you want to reject connections without a valid client certificate.
• Click the Apply button to finish the TLS parameters.