Skip to content
Docs sslbrain sslbrain.com

F5 BIG-IP

Copy link to the page “F5 BIG-IP”

← All integrations

Load balancer

Installs the certificate and key, repoints client-ssl profiles and syncs HA.

The appliance runs the package and connects to F5 BIG-IP through iControl REST over HTTPS on port 443. No agent is installed on F5 BIG-IP.

What happens

  1. The appliance connects to F5 BIG-IP through iControl REST on port 443.
  2. The certificate, key and intermediates are installed as objects.
  3. The client-ssl profiles point at the new certificate and the HA group is synced when chosen. If it fails: Rollback puts the profiles' previous references back and syncs.
  4. Verification: the package reads back the bound certificate and tests the certificate each virtual server using the profile serves over TLS.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to iControl REST, port 443. No agent is installed.
You need
Admin user name and password for the management interface.
Platform
BIG-IP LTM 13.1 to 17.x
Actions
Discovery, Installation, Verification, Rollback, Removal
Packages
f5-bigip-api 1.2.1
Note
  • TLS verification covers direct TLS connections. Unreachable VIPs, listeners requiring client certificates and other protocols have configuration checks only. HA synchronisation does not verify the certificate on each peer.
  • Discovery finds the version, certificates, client-ssl profiles with SNI and inheritance, virtual servers, bindings and HA state. Rollback restores only profile references that still match the deployment.
  • Management TLS checks the trust chain and hostname by default. MANAGEMENT_TLS_PIN_SHA256 accepts exactly the saved certificate before login; MANAGEMENT_TLS_CA_BUNDLE uses a private CA file. MANAGEMENT_TLS_INSECURE is an explicit opt-out with a warning. F5_TLS_CA_BUNDLE remains an alias; legacy F5_TLS_INSECURE=true is refused when it is the effective setting. Service TLS probes use separate trust.
  • Discovery supplies full client-ssl profile IDs; select leaf profiles or specify them explicitly. Parent profiles are inventory-only. Rule deployments use a stable certificate family. Raw PEM from appliance 0.4.44 and base64 input from 0.4.45 are supported; the same saved username and password authenticate to iControl REST.

Get started