Manage Multiple Custom Certificates

• Select Multi-Cloud App Connect service in the home page.

• Select Certificate Management from the left menu and select TLS Certificates.

• Click Add TLS Certificate.

• Enter a name in the Name field of the metadata section.

• Optionally, set labels and add a description for your chain.

• In the Certificate field, click Import from File.

• In the import window, click Upload File to upload the certificate file in PEM or PKCS12 format. The page will display password and key configuration settings according to the certificate format.

Note: In case of PKCS12 format, the certificate and key are in the same file, so the key field is not displayed, but password field is displayed and needs to be entered. In case of PEM format, you will be required to upload a key file, but password is not required. This example shows PKCS12 format.

• Enter password in the Password field.

• Optionally, select a key choice for the Key Type field. Blindfold is selected by default.

• Optionally, select a policy choice for the Policy Type field. A default built-in policy is selected by default. If you choose Custom, select a policy from the Custom Policy drop-down.

Figure: Upload Certificate File

• Click Import. The certificate data gets imported.

Figure: Certificate Imported

• Select one of the following for the OCSP Stapling choice field:

  • Fetch with F5XC default settings - Staples OCSP response using the F5 Distributed Cloud default settings.
  • Disable OCSP Stapling - This is set by default and disables OCSP stapling.
  • Use hash algorithms in custom order - Fetches the response in the specified order of algorithms. Specify the order by selecting choices in the Hash Algorithms field.

Note: See OCSP Stapling for more information on generating certificates with OCSP Stapling.

Creating Intermediate Chain

A user may choose to create an intermediate chain certificate or may combine both in one single TLS certificate file. Therefore, creating intermediate chain object is optional. The following steps show how to create intermediate chain object and associate it with the TLS certificate:

• Click on the Intermediate Certificate Chain field and click Add Item to create a new chain and apply it.

Note: You can also select an existing chain object from the displayed list.

• Enter a name in the Name field of the metadata section.

• Optionally, set labels and add a description for your chain.

• In the Certificate field, either enter the intermediate chain string or click Upload File to upload the chain certificate in PEM format.

Figure: Upload Chain Certificate File

• Click Save and Exit to complete creating the chain object.

Click Save and Exit to complete creating the TLS certificate.

Note: Perform Step 1 to Step 4 to create more certificates as per your requirement.

• Select Multi-Cloud App Connect service in the home page.

• Select Manage > Load Balancers > HTTP Load Balancers.

• Click Add HTTP Load Balancer.

• In the Name field, enter a name for the new load balancer.

• In the Domains field, enter a domain name. You can use wildcards to catch prefixes and suffixes. Click Add item to add more domains, if needed.

• Select HTTPS with Custom Certificate for the Load Balancer Type field.

• Select for Multiple Certificates for the TLS Configuration field and click Configure under the Multiple Certificates field.

• In the TLS parameters page, click on the drop-down list in the Certificates field and select the certificate created in the previous chapter. Alternatively, you can also use Add Item in the drop-down to create a new certificate and apply.

Figure: Add TLS Certificate to Load Balancer

• Use the Add Item in the Certificates field to add more than one certificate.

• After adding certificates, click Apply to add certificates to the load balancer TLS configuration.

Note: Ensure that there is a certificate for each domain. A domain can have multiple certificates and a certificate can be mapped to multiple domains. The following order of priority is considered while mapping each domain to a TLS certificate:

1. Choose non-wildcard certificate over wildcard certificate
2. Choose certificate with the latest expiration date
3. Choose certificate matching CN over the one matching only via SAN

• Continue configuring the settings such as origin pools, security settings, advertisement, etc. For more information, see HTTP Load Balancer guide.

• Click Save and Exit to complete creating the load balancer.