Integrations

F5 BIG-IP Certificate Automation

R13 First-Party Network Target

SSL Nexus can register F5 BIG-IP as a first-party network deployment target and use the native iControl REST API for management health checks and certificate deployment. The target is available to Administrators, Operators and appliance-scoped Network Operators.

R13 status: this implementation is ready for lab validation. Validate it against the BIG-IP software version and Client SSL profile design used in your estate before enabling unattended production renewal.

Prerequisites

HTTPS management reachability from the SSL Nexus control plane to BIG-IP, normally on TCP 443.
A dedicated BIG-IP automation identity with the permissions required to authenticate through iControl REST and manage the selected SSL certificate/key objects and Client SSL profile.
The BIG-IP partition that contains the objects, normally Common.
An existing Client SSL profile that SSL Nexus is explicitly allowed to update.
A target-bound CA profile configured in SSL Nexus.

Add An F5 BIG-IP Target

Open Deployment targets and choose Add target.
Select platform Network and application F5 BIG-IP.
Enter the BIG-IP management FQDN/address, HTTPS API port, API username and credential.
Set Partition. SSL Nexus defaults this to Common.
Set Certificate/key object name. SSL Nexus manages the certificate and key objects under this name.
Set the existing Client SSL profile that should reference the managed certificate/key pair.
Set Login provider. The default is tmos; change it only when the BIG-IP authentication configuration requires another provider.
Select and configure the CA adapter for this target, then save.

Profile guardrail
The Client SSL profile is mandatory and must be entered explicitly. SSL Nexus does not search for a likely production profile and does not silently rebind an arbitrary virtual server.

Test Connection

Test connection authenticates to BIG-IP using the saved API identity and performs a non-mutating application-level health check. It is independent from Test CA, which checks the certificate authority stored on the same deployment target. Use both tests before attaching a production certificate.

Deployment Workflow

SSL Nexus authenticates to iControl REST and reads the explicitly configured Client SSL profile.
The issued certificate and private key are staged through the BIG-IP REST file-transfer endpoint.
SSL Nexus creates or updates the managed SSL key object and certificate object in the configured partition.
The configured Client SSL profile is updated to reference those managed objects.
SSL Nexus confirms the certificate object is present and records the appliance binding for later renewals.
Temporary staged uploads are removed after the operation.

Object Naming And Renewal Binding

The target stores the partition, certificate/key object name and Client SSL profile as part of the deployment binding. Later renewals reuse that explicit relationship instead of rediscovering a different profile. Target validation rejects unsupported object/profile characters before work reaches BIG-IP.

Client SSL Profile Compatibility

The R13 implementation updates the certificate and key properties exposed by the BIG-IP Client SSL profile for compatibility. Modern BIG-IP deployments can use certificate-key-chain configurations, including designs that keep more than one certificate/key pair on a profile. Before production use, verify that the selected profile is compatible with the R13 binding model and that an RSA/ECDSA or multi-certificate configuration will not be unintentionally simplified.

Next F5 hardening pass: live BIG-IP testing should be used to finalise certificate-key-chain preservation and multi-certificate profile handling. Do not enable automatic renewal on those profile designs until that validation is complete.

Credentials And Management TLS

The BIG-IP API credential is encrypted in the deployment-target store and is not returned by the API after saving. If the appliance currently presents a self-signed or otherwise untrusted management certificate, the target can temporarily allow untrusted management TLS during onboarding. Disable that exception after a trusted management certificate is installed.

Production Validation Checklist

Test connection succeeds with the dedicated automation identity.
Test CA succeeds independently.
The expected partition and certificate/key object names are created or updated.
The intended Client SSL profile, and only that profile, references the new objects.
The production-like virtual server presents the expected certificate after deployment.
Your rollback procedure is tested before unattended renewal is enabled.