Skip to content

Commit 2667e30

Browse files
leefine02leefine02
authored
Merge c356dc2 into c2a86f0 
2 parents c2a86f0 + c356dc2 commit 2667e30

File tree

7 files changed

+41
-53
lines changed

7 files changed

+41
-53
lines changed

‎F5Client.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,9 @@ public void AddEntry(string partition, string name, string b64Certificate, strin
9191
{
9292
LogHandlerCommon.MethodEntry(logger, CertificateStore, "AddEntry");
9393
LogHandlerCommon.Trace(logger, CertificateStore, $"Processing certificate for partition '{partition}' and name '{name}'");
94+
LogHandlerCommon.Trace(logger, CertificateStore, $"*** CERT CONTENTS: *** {b64Certificate}");
9495
byte[] entryContents = Convert.FromBase64String(b64Certificate);
96+
LogHandlerCommon.Trace(logger, CertificateStore, $"*** AFTER CERT CONTENTS: ***");
9597
string password = PFXPassword;
9698
CertificateConverter converter = CertificateConverterFactory.FromDER(entryContents, password);
9799
X509Certificate2 certificate = converter.ToX509Certificate2(password);

‎README.md

Lines changed: 31 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -31,24 +31,16 @@
3131

3232
## Overview
3333

34-
The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below:
35-
36-
- CA Bundles
37-
- Discovery
38-
- Inventory*
39-
- Management (Add and Remove)
40-
- Web Server Device Certificates
41-
- Inventory*
42-
- Management (Add, but replacement/renewal of existing certificate only)
43-
- SSL Certificates
44-
- Discovery
45-
- Inventory*
46-
- Management (Add and Remove)
47-
48-
*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores.
34+
The f5-rest-orchestrator orchestrator extension manages various types of certificates on a F5 Big IP device (version 15 or later). TLS certificates, CA bundles, and the certificate protecting the administrative website can all be managed with this integration within the scope described in the sections below. One important note, this integration DOES NOT handle high availability (HA) failover between primary and secondary nodes. If syncing between primary and secondary nodes is desired, this must either be handled within your F5 Big IP instance itself, or you can set up a Keyfactor Command certificate store for each node (primary and secondary) and manage each separately.
4935

5036
The F5 Universal Orchestrator extension implements 3 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types. Descriptions of each are provided below.
5137

38+
- [F5 SSL Profiles REST](#F5-SL-REST)
39+
40+
- [F5 WS Profiles REST](#F5-WS-REST)
41+
42+
- [F5 CA Profiles REST](#F5-CA-REST)
43+
5244

5345
## Compatibility
5446

@@ -69,16 +61,21 @@ An administrator account must be set up in F5 to be used with this orchestrator
6961

7062
## Certificate Store Types
7163

72-
To use the F5 Universal Orchestrator extension, you **must** create the Certificate Store Types required for your usecase. This only needs to happen _once_ per Keyfactor Command instance.
64+
To use the F5 Universal Orchestrator extension, you **must** create the Certificate Store Types required for your use-case. This only needs to happen _once_ per Keyfactor Command instance.
7365

7466
The F5 Universal Orchestrator extension implements 3 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types.
7567

7668
### F5-SL-REST
7769

78-
7970
<details><summary>Click to expand details</summary>
8071

8172

73+
The F5-SL-REST certificate store type manages F5 Big IP TLS certificates. Renewals of bound certificates is supported, but adding new bindings for new or replacement certificates is not.
74+
75+
76+
77+
78+
8279

8380

8481
#### Supported Operations
@@ -94,7 +91,7 @@ The F5 Universal Orchestrator extension implements 3 Certificate Store Types. De
9491
#### Store Type Creation
9592

9693
##### Using kfutil:
97-
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to created certificate store types.
94+
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
9895
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
9996
<details><summary>Click to expand F5-SL-REST kfutil details</summary>
10097

@@ -176,16 +173,20 @@ the Keyfactor Command Portal
176173

177174
![F5-SL-REST Custom Fields Tab](docsource/images/F5-SL-REST-custom-fields-store-type-dialog.png)
178175

179-
180176
</details>
181177
</details>
182178

183179
### F5-WS-REST
184180

185-
186181
<details><summary>Click to expand details</summary>
187182

188183

184+
The F5-WS-REST certificate store type manages the TLS certificate bound to the F5 administration website. While replacing the existing website certificate is supported, adding a new certificate if one is not already present is not due to F5 limitations.
185+
186+
187+
188+
189+
189190

190191

191192
#### Supported Operations
@@ -201,7 +202,7 @@ the Keyfactor Command Portal
201202
#### Store Type Creation
202203

203204
##### Using kfutil:
204-
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to created certificate store types.
205+
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
205206
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
206207
<details><summary>Click to expand F5-WS-REST kfutil details</summary>
207208

@@ -282,16 +283,20 @@ the Keyfactor Command Portal
282283

283284
![F5-WS-REST Custom Fields Tab](docsource/images/F5-WS-REST-custom-fields-store-type-dialog.png)
284285

285-
286286
</details>
287287
</details>
288288

289289
### F5-CA-REST
290290

291-
292291
<details><summary>Click to expand details</summary>
293292

294293

294+
The F5-CA-REST certificate store type manages F5 Big IP CA certificate bundles. Only custom CA bundles are supported by this integration. The default ""ca-bundle"" CA bundle under the "Common" partition is **not** supported, as F5's REST API endpoints will not return certificates from this bundle.
295+
296+
297+
298+
299+
295300

296301

297302
#### Supported Operations
@@ -307,7 +312,7 @@ the Keyfactor Command Portal
307312
#### Store Type Creation
308313

309314
##### Using kfutil:
310-
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to created certificate store types.
315+
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
311316
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
312317
<details><summary>Click to expand F5-CA-REST kfutil details</summary>
313318

@@ -388,7 +393,6 @@ the Keyfactor Command Portal
388393

389394
![F5-CA-REST Custom Fields Tab](docsource/images/F5-CA-REST-custom-fields-store-type-dialog.png)
390395

391-
392396
</details>
393397
</details>
394398

@@ -539,12 +543,9 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
539543
</details>
540544
541545
542-
543546
> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
544547
545548
546-
547-
548549
</details>
549550
550551
<details><summary>F5 WS Profiles REST (F5-WS-REST)</summary>
@@ -640,12 +641,9 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
640641
</details>
641642
642643
643-
644644
> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
645645
646646
647-
648-
649647
</details>
650648
651649
<details><summary>F5 CA Profiles REST (F5-CA-REST)</summary>
@@ -670,7 +668,7 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
670668
| Category | Select "F5 CA Profiles REST" or the customized certificate store name from the previous step. |
671669
| Container | Optional container to associate certificate store with. |
672670
| Client Machine | The server name or IP Address for the F5 device. |
673-
| Store Path | Enter the name of the partition on the F5 device you wish to manage. This value is case sensitive, so if the partition name is "Common", it must be entered as "Common" and not "common", |
671+
| Store Path | Enter the name of the partition followed by the name of the bundle separated by a / (i.e. Common/BundleName). This value is case sensitive, so if the partition name is "Common/BundleName", it must be entered as "Common/BundleName" and not "common/bundlename", |
674672
| Orchestrator | Select an approved orchestrator capable of managing `F5-CA-REST` certificates. Specifically, one with the `F5-CA-REST` capability. |
675673
| PrimaryNode | Only required (and shown) if Primary Node Online Required is added and selected. Enter the Host Name of the F5 device that acts as the primary node in a highly available F5 implementation. Please note that this value IS case sensitive. |
676674
| PrimaryNodeCheckRetryWaitSecs | Enter the number of seconds to wait between attempts to add/replace/renew a certificate if the node is inactive. |
@@ -704,7 +702,7 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
704702
| Category | Select "F5 CA Profiles REST" or the customized certificate store name from the previous step. |
705703
| Container | Optional container to associate certificate store with. |
706704
| Client Machine | The server name or IP Address for the F5 device. |
707-
| Store Path | Enter the name of the partition on the F5 device you wish to manage. This value is case sensitive, so if the partition name is "Common", it must be entered as "Common" and not "common", |
705+
| Store Path | Enter the name of the partition followed by the name of the bundle separated by a / (i.e. Common/BundleName). This value is case sensitive, so if the partition name is "Common/BundleName", it must be entered as "Common/BundleName" and not "common/bundlename", |
708706
| Orchestrator | Select an approved orchestrator capable of managing `F5-CA-REST` certificates. Specifically, one with the `F5-CA-REST` capability. |
709707
| Properties.PrimaryNode | Only required (and shown) if Primary Node Online Required is added and selected. Enter the Host Name of the F5 device that acts as the primary node in a highly available F5 implementation. Please note that this value IS case sensitive. |
710708
| Properties.PrimaryNodeCheckRetryWaitSecs | Enter the number of seconds to wait between attempts to add/replace/renew a certificate if the node is inactive. |
@@ -741,12 +739,9 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
741739
</details>
742740
743741
744-
745742
> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
746743
747744
748-
749-
750745
</details>
751746
752747
## Discovering Certificate Stores with the Discovery Job

‎docsource/content.md

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,6 @@
11
## Overview
22

3-
The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below:
4-
5-
- CA Bundles
6-
- Discovery
7-
- Inventory*
8-
- Management (Add and Remove)
9-
- Web Server Device Certificates
10-
- Inventory*
11-
- Management (Add, but replacement/renewal of existing certificate only)
12-
- SSL Certificates
13-
- Discovery
14-
- Inventory*
15-
- Management (Add and Remove)
16-
17-
*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores.
18-
3+
The f5-rest-orchestrator orchestrator extension manages various types of certificates on a F5 Big IP device (version 15 or later). TLS certificates, CA bundles, and the certificate protecting the administrative website can all be managed with this integration within the scope described in the sections below. One important note, this integration DOES NOT handle high availability (HA) failover between primary and secondary nodes. If syncing between primary and secondary nodes is desired, this must either be handled within your F5 Big IP instance itself, or you can set up a Keyfactor Command certificate store for each node (primary and secondary) and manage each separately.
194

205
## Requirements
216

‎docsource/f5-ca-rest.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
## Overview
2+
3+
The F5-CA-REST certificate store type manages F5 Big IP CA certificate bundles. Only custom CA bundles are supported by this integration. The default ""ca-bundle"" CA bundle under the "Common" partition is **not** supported, as F5's REST API endpoints will not return certificates from this bundle.

‎docsource/f5-sl-rest.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
## Overview
2+
3+
The F5-SL-REST certificate store type manages F5 Big IP TLS certificates. Renewals of bound certificates is supported, but adding new bindings for new or replacement certificates is not.

‎docsource/f5-ws-rest.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
## Overview
2+
3+
The F5-WS-REST certificate store type manages the TLS certificate bound to the F5 administration website. While replacing the existing website certificate is supported, adding a new certificate if one is not already present is not due to F5 limitations.

‎integration-manifest.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@
254254
"Capability": "F5-CA-REST",
255255
"ServerRequired": true,
256256
"ClientMachineDescription": "The server name or IP Address for the F5 device.",
257-
"StorePathDescription": "Enter the name of the partition on the F5 device you wish to manage. This value is case sensitive, so if the partition name is \"Common\", it must be entered as \"Common\" and not \"common\",",
257+
"StorePathDescription": "Enter the name of the partition followed by the name of the bundle separated by a / (i.e. Common/BundleName). This value is case sensitive, so if the partition name is \"Common/BundleName\", it must be entered as \"Common/BundleName\" and not \"common/bundlename\",",
258258
"SupportedOperations": {
259259
"Add": true,
260260
"Create": false,

0 commit comments

Comments
 (0)