Ask a Question

Advanced Search

Solution ID : SO15237

Last Modified : 05/02/2018

Install a GeoTrust True BusinessID with EV on F5 Big IP Controller 4.0

Problem

How do I install a GeoTrust True BusinessID with EV on F5 Big IP Controller 4.0

Solution

To install your GeoTrust True BusinessID with EV on F5 Big IP 4.0, perform the following steps:
 
Step 1: Obtain the GeoTrust SSL Extended Validation Root CA Certificate
 
a) Download the GeoTrust EV Intermediate CA from the following solution: AR1421
 
 
Note: Be sure to use Vi or Notepad as word processing programs like Microsoft Notepad may add additional characters that may render the certificate unusable.
 
b) Copy and paste the Intermediate CA into a text file and save as "intermediate.cer".

 
Step2. Installing your certificate
 
1. Download your certificate as per the instruction on the following solution: 
  • GeoTrust Security Center, refer to solution SO22158
  • GeoTrust Enterprise Security Center, refer to solution SO21128
  • GeoTrust User Portal (e.g., certificate purchased through Retail or Partners), refer to solution SO15168
 
2. Save the file with a .crt extension. Example: cert.crt
 
 
To install certificates from the CA using the Configuration utility
 
In the navigation pane, click Proxies. The Proxies screen opens.
 
On Proxies screen, click the Install SSL Certificate Request tab. The Install SSL Certificate screen opens.
 
In the Certfile Name box, type the fully qualified domain name of the server with the file extension .crt. If you generated a temporary certificate when you submitted a request to the CA, you can select the name of the certificate from the drop down list. This allows you to overwrite the temporary certificate with the certificate from the CA.
 
Paste the text of the certificate into the install SSL Certificate window. Make sure you include the BEGIN CERTIFICATE line and the END CERTIFICATE line. For an example of a certificate, see Figure 1.0.
 
Click the Write Certificate File button to install the certificate. After the certificate is installed, you can continue with the next step in creating an SSL gateway for the server.
 
To install certificates from the CA using the command line
 
Copy the certificate into the following directory on each BIG-IP Controller in a redundant system:
 
/config/bigconfig/ssl.crt/
 
Note: The certificate you receive from the certificate authority (CA) should overwrite the temporary certificate generated by genkey or gencert.
 
If you used the genkey or gencert utilities to generate the request file, a copy of the corresponding key should already be in the following directory on the BIG-IP Controller:
 
Figure 1.0 An example of a certificate
 
-----BEGIN CERTIFICATE-----
MIIB1DCCAX4CAQAwDQYJKoZIhvcNAQEEBQAwdTELMAkGA1UEBhMCVVMxCzAJBgNV
BAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMRQwEgYDVQQKEwtGNSBOZXR3b3JrczEc
MBoGA1UECxMTUHJvZHVjdCBEZXZlbG9wbWVudDETMBEGA1UEAxMKc2VydmVyLm5l
dDAeFw0wMDA0MTkxNjMxNTlaFw0wMDA1MTkxNjMxNTlaMHUxCzAJBgNVBAYTAlVT
MQswCQYDVQQIEwJXQTEQMA4GA1UEBxMHU2VhdHRsZTEUMBIGA1UEChMLRjUgTmV0
d29ya3MxHDAaBgNVBAsTE1Byb2R1Y3QgRGV2ZWxvcG1lbnQxEzARBgNVBAMTCnNl
cnZlci5uZXQwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAsfCFXq3Jt+FevxUqBZ9T
Z7nHx9uaF5x9V5xMZYgekjc+LrF/yazhmq4PCxrws3gvJmgpTsh50YJrhJgfs2bE
gwIDAQABMA0GCSqGSIb3DQEBBAUAA0EAd1q6+u/aMaM2qdo7EjWx14TYQQGomYoq
eydlzb/3FOiJAynDXnGnSt+CVvyRXtvmG7V8xJamzkyEpZd4iLacLQ==
-----END CERTIFICATE-----
 
After the certificate is installed, you can continue with the next step in creating an SSL gateway for the server.
 
To install certificates from the CA using the command line Copy the certificate into the following directory on each BIG-IP Controller in a redundant system:
 
/config/bigconfig/ssl.crt/
 
Note: The certificate you receive from the certificate authority (CA) should overwrite the temporary certificate generated by genkey or gencert.
 
If you used the genkey or gencert utilities to generate the request file, a copy of the corresponding key should already be in the following directory on the BIG-IP Controller:
 
/config/bigconfig/ssl.key/
 
To install the intermediate certificate using the command line :
 
*Copy the intermediate certificate into each BIG-IP Controller in a redundant system.
 
To install the intermediate certificate, follow the steps below.
 
Cut and paste the entire text of the certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, into a file named intermediate-ca.cer. Be careful not to include any leading or trailing whitespace before the beginning and ending hyphens.
 
Make a directory named ca in /var/asr/gateway.
 
Copy the file intermediate-ca.cert into this directory.
 
For example:
 
bigip1:/var/tmp# mkdir /var/asr/gateway/ca
bigip1:/var/tmp# cp intermediate-ca.cert /var/asr/gateway/ca/
bigip1:/var/tmp#

 
Run the following command to reload the configuration and restart proxy: bigpipe -f /etc/bigip.conf
 
WARNING:In a redundant system, the keys and certificates must be in place on both controllers before you configure the SSL Accelerator. You must do this manually; the configuration synchronization utilities do not perform this function.