Knowledge Base

f5 BIG-IP SSL Certificate Installation

If you have not yet created a Certificate Signing Request (CSR) and ordered your certificate, see:

F5 BIG-IP : Generating a CSR for Issuance of an SSL Certificate

Install your SSL Certificate to a f5 BIG-IP Loadbalancer (version 9)

Installing the SSL Certificate

1. Launch the F5 BIGIP web GUI.
2. Under Local Traffic select "SSL Certificates."
3. Click on the name you assigned to the certificate under "General Properties" while creating the CSR.
4. Browse to the your_domain_name.crt file that you received from DigiCert.

5. Click "Open" and then "Import."

   Your SSL Certificate file is now installed.

Enabling your Intermediate Certificate

1. In the web GUI, choose "Local Traffic," then "SSL Certificates," and then "Import."
2. Under "Import Type," choose Certificate, then "Create New."
3. Enter "DigiCertCA" as your certificate name.

4. Browse to the DigiCertCA.crt file that you received from DigiCert, click "Open," and then "Import."

   Your intermediate certificate should now be imported.

Configure your server for SSL

1. Create or open the SSL Profile that you will be using with this certificate.
2. Log in to the Configuration utility > Local Traffic > Profiles > Client (from the SSL menu), then select the client to configure and choose "Advanced" from the Configuration menu.
3. Select the SSL certificate (public/private key pair) that you installed at the beginning of these instructions.

4. Under the "Chain" section, browse to the "DigiCertCA" file that you imported in the previous step, then save and exit the configuration

   Learn More About F5 SSL

   Your SSL Certificate has now been installed and enabled for use on your server.

 
f5 BIG-IP Pre Version 9.x

Inside your DigiCert account, you can download your certificate files. You need the Primary (your_domain_name.crt) and Intermediate (DigiCertCA.crt) certificate files. You will need both files for proper installation on your BIG-IP device. You do not need the TrustedRoot.crt file

1. Move your Primary and Intermediate Certificates to the BIG-IP device.

   The Primary (your_domain_name.crt) and Intermediate (intermediate-ca.crt) certificate files can be moved to the BIG-IP box using FTP.

2. Rename and move the certificate files.

   Rename your Primary certificate from your_domain_name.crt to your.domain.name.crt and copy it to the /config/bigconfig/ssl.crt/ folder.

   Copy the intermediate-ca.crt to the /config/bigconfig/ssl.crt/ folder.

3. Restart the Proxy.

   # bigpipe proxy <IP Address>:443 disable
   # bigpipe proxy <IP Address>:443 enable

   The Certificate is now installed.