Skip to content

Commit 204c408

Browse files
bhillkeyfactorbhillkeyfactor
authored
Update content.md
1 parent 68b1ba8 commit 204c408

File tree

1 file changed

+150
-36
lines changed

1 file changed

+150
-36
lines changed

‎docsource/content.md‎

Lines changed: 150 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,163 @@
11
## Overview
22

3-
The Keyfactor A10 vThunder Universal Orchestrator Extension facilitates the management of SSL certificates on A10 Networks' vThunder appliances. It offers two primary certificate store types:
3+
A Keyfactor Universal Orchestrator extension for managing SSL/TLS certificates on A10 Networks vThunder load balancers through direct API integration and SCP-based management interface certificate deployment.
44

5-
1. **ThunderSsl**: Manages SSL certificates for securing traffic handled by the device, such as in SSL offloading, SSL intercept, and reverse proxy configurations.
6-
2. **ThunderMgmt**: Manages certificates securing HTTPS access to the A10 management interface (GUI/API).
5+
The A10 vThunder Orchestrator provides automated certificate lifecycle management for A10 Networks vThunder appliances. It implements two distinct certificate store types:
76

8-
- **A10 Thunder Version**: Tested with A10 Thunder v6.0.5-P5 (Build 51).
9-
- **Automated Certificate Deployment**: Streamlines the deployment of SSL certificates to the A10 vThunder appliance.
10-
- **Certificate Inventory Management**: Provides visibility into existing certificates on the appliance.
11-
- **Integration with Keyfactor Command**: Enables centralized certificate lifecycle management.
7+
1. **ThunderSsl**: Direct API-based management of SSL certificates for load balancing and application delivery
8+
2. **ThunderMgmt**: SCP-based management of certificates for the A10 management interface (GUI/API access)
129

13-
## Test Cases
14-
<details>
15-
<summary>Management & SSL Certificate Operations</summary>
10+
### Key Features
1611

17-
Case Number|Case Name|Store Path|Enrollment Params|Expected Results|Passed|Screenshots
18-
-------|----------|------------------|--------------------|----------------------------|----|--------
19-
TC1|Add Unbound Certificate|shared|**Alias**:<br>&lt;random&gt;<br>**Overwrite**:<br>false|Cert and Chain Added|True|![](images/TC1.gif)
20-
TC2|Remove Unbound Certificate|shared|**Alias**:<br>&lt;same-random&gt;<br>**Overwrite**:<br>false|Cert Removed Successfully|True|![](images/TC2.gif)
21-
TC3|Add Certificate to New Partition|keyfactor2|**Alias**:<br>&lt;random&gt;<br>**Overwrite**:<br>false|Cert Added to Partition|True|![](images/TC3.gif)
22-
TC4|Remove Cert from Partition|keyfactor2|**Alias**:<br>&lt;same-random&gt;<br>**Overwrite**:<br>false|Cert Removed from Partition|True|![](images/TC4.gif)
23-
TC5|Renew Bound Cert With Overwrite|shared|**Alias**:<br>&lt;entered-name&gt;<br>**Overwrite**:<br>true|Cert Renamed and Rebound|True|![](images/TC5.gif)
24-
TC6|Renew Bound Cert in Different Partition|keyfactor2|**Alias**:<br>&lt;entered-name&gt;<br>**Overwrite**:<br>true|Cert Renamed and Rebound|True|![](images/TC6.gif)
25-
TC7|Attempt to Remove Bound Cert (Not Allowed)|keyfactor2|**Alias**:<br>&lt;entered-name&gt;<br>**Overwrite**:<br>true|Error: Bound Cert Cannot Be Removed|True|![](images/TC7.gif)
12+
- **Direct SSL Certificate Management**: Native A10 API integration for SSL certificate deployment and management
13+
- **Template-Aware Operations**: Intelligent handling of certificates bound to SSL templates and virtual services
14+
- **Multi-API Version Support**: Automatic detection and support for A10 API v4 and v6
15+
- **Partition Support**: Full support for A10 partitions for multi-tenant deployments
16+
- **Certificate Inventory**: Comprehensive discovery and inventory of existing certificates
17+
- **Management Interface Certificates**: SCP-based deployment for A10 management interface certificates
18+
- **PAM Integration**: Support for Privileged Access Management systems
19+
- **Advanced Certificate Replacement**: Zero-downtime certificate replacement with automatic template rebinding
2620

27-
</details>
21+
### Architecture
2822

29-
<details>
30-
<summary>Inventory Tests</summary>
23+
#### ThunderSsl Store Type
24+
Uses A10's native REST API (AXAPI) for direct certificate management:
25+
- Certificates are uploaded directly to the A10 appliance
26+
- Supports both certificate-only and certificate-with-private-key operations
27+
- Automatically detects and handles template bindings and virtual service configurations
28+
- Implements intelligent certificate replacement to avoid service disruption
3129

32-
Case Number|Case Name|Store Path|Enrollment Params|Expected Results|Passed|Screenshots
33-
-------|----------|------------------|--------------------|----------------------------|----|--------
34-
TC8|Inventory From Partition|keyfactor2|—|Partition Certs Listed|True|![](images/TC8.gif)
35-
TC9|Inventory From Shared Location|shared|—|Shared Certs Listed|True|![](images/TC9.gif)
36-
TC14|Inventory Management Certs from SCP|/home/ec2-user|—|Mgmt Certs Retrieved from SCP|True|![](images/TC14.gif)
30+
#### ThunderMgmt Store Type
31+
Uses SCP (Secure Copy Protocol) for management interface certificates:
32+
- Orchestrator uploads certificates to an intermediate Linux SCP server
33+
- A10 appliance retrieves certificates from the SCP server via API calls
34+
- Designed for management interface SSL certificate deployment
3735

38-
</details>
36+
#### A10 vThunder Requirements
37+
- A10 vThunder appliance with AXAPI support
38+
- API versions 4.x or 6.x supported (automatically detected)
39+
- Valid user account with certificate management privileges
40+
- For ThunderMgmt: SSH/SCP access enabled
41+
42+
#### Required A10 Permissions
43+
The orchestrator requires an A10 user account with permissions to:
44+
- Access AXAPI (REST API)
45+
- Manage SSL certificates and private keys
46+
- Read/write SSL templates (server-ssl and client-ssl)
47+
- Query and modify virtual services
48+
- Write configuration to memory
49+
- Set active partitions
50+
- For ThunderMgmt: SSH/SCP file operations
51+
52+
## Certificate Alias Management
53+
54+
Understanding how aliases work is crucial for proper certificate management across both store types.
55+
56+
#### ThunderSsl Aliases
57+
58+
In the ThunderSsl store type, the **alias** directly corresponds to the certificate and private key names stored on the A10 appliance:
59+
60+
- **Certificate Name**: The alias becomes the SSL certificate identifier in A10's certificate store
61+
- **Private Key Name**: The same alias is used for the associated private key
62+
- **Template References**: SSL templates reference certificates by this exact alias name
63+
- **API Operations**: All A10 API calls use this alias to identify the certificate/key pair
64+
65+
##### Example ThunderSsl Usage
66+
```
67+
Alias: "webserver-prod-2025"
68+
→ A10 Certificate: "webserver-prod-2025"
69+
→ A10 Private Key: "webserver-prod-2025"
70+
→ Template Reference: server-ssl template uses cert "webserver-prod-2025"
71+
```
72+
73+
##### Alias Renaming for Template-Bound Certificates
74+
75+
When replacing a certificate that's bound to SSL templates, the orchestrator uses an intelligent renaming strategy:
76+
77+
1. **Timestamp Generation**: Creates a Unix timestamp (10 digits)
78+
2. **Alias Pattern Matching**:
79+
- If alias contains existing timestamp: `webserver-prod_1640995200` → `webserver-prod_1672531200`
80+
- If no timestamp found: `webserver-prod` → `webserver-prod_1672531200`
81+
3. **Length Validation**: Ensures final alias stays within A10's 240-character limit
82+
4. **Template Updates**: All SSL templates are updated to reference the new timestamped alias
83+
5. **Cleanup**: Original certificate is removed after successful template updates
84+
85+
##### Replacement Workflow Example
86+
```
87+
Original: "api-gateway-cert"
88+
Step 1: Generate new alias → "api-gateway-cert_1672531200"
89+
Step 2: Upload certificate with new alias
90+
Step 3: Update server-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
91+
Step 4: Update client-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
92+
Step 5: Remove old certificate "api-gateway-cert"
93+
Step 6: Rebind templates to virtual services
94+
```
95+
96+
#### ThunderMgmt Aliases
97+
98+
In the ThunderMgmt store type, the **alias** determines the filename for certificates stored on the SCP server:
99+
100+
- **Certificate File**: `{alias}.crt` on the SCP server
101+
- **Private Key File**: `{alias}.key` on the SCP server
102+
- **A10 API Reference**: The A10 management interface loads certificates using SCP URLs pointing to these files
103+
104+
##### Example ThunderMgmt Usage
105+
```
106+
Alias: "mgmt-interface-cert"
107+
→ SCP Server Files:
108+
- /home/scpuser/mgmt-interface-cert.crt
109+
- /home/scpuser/mgmt-interface-cert.key
110+
→ A10 API Call:
111+
- Certificate URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.crt
112+
- Key URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.key
113+
```
114+
115+
##### ThunderMgmt File Management
116+
117+
The orchestrator handles file operations as follows:
118+
119+
1. **Add Operation**:
120+
- Uploads `{alias}.crt` and `{alias}.key` to SCP server
121+
- Calls A10 API to load certificate from SCP URLs
122+
- A10 device pulls files directly from SCP server
123+
124+
2. **Remove Operation**:
125+
- Deletes `{alias}.crt` and `{alias}.key` from SCP server
126+
- Does not modify A10 management interface configuration
127+
128+
3. **Replace Operation** (with Overwrite=true):
129+
- Overwrites existing `{alias}.crt` and `{alias}.key` files
130+
- Calls A10 API to reload certificate from same SCP URLs
131+
132+
#### Alias Best Practices
133+
134+
##### For ThunderSsl
135+
- Use descriptive names that indicate purpose: `web-frontend-ssl`, `api-backend-tls`
136+
- Avoid special characters that might conflict with A10 naming rules
137+
- Consider including environment indicators: `prod-web-cert`, `stage-api-cert`
138+
- Remember that renaming will append timestamps for template-bound certificates
139+
140+
##### For ThunderMgmt
141+
- Use names that clearly identify the management purpose: `mgmt-interface-2025`
142+
- Ensure filenames are valid for both SCP server filesystem and A10 API calls
143+
- Consider including renewal dates: `mgmt-cert-jan2025`
144+
145+
##### Character Limitations
146+
- **Maximum Length**: 240 characters (enforced by orchestrator)
147+
- **Recommended Characters**: Letters, numbers, hyphens, underscores
148+
- **Avoid**: Special characters that might cause issues in API calls or file operations
149+
150+
#### Troubleshooting Alias Issues
151+
152+
##### ThunderSsl Common Issues
153+
- **Template Update Failures**: Verify templates exist and are accessible
154+
- **Long Alias Names**: Orchestrator will truncate to fit timestamp if needed
155+
- **Special Characters**: May cause API call failures
156+
157+
##### ThunderMgmt Common Issues
158+
- **File Path Issues**: Ensure SCP user has access to the target directory
159+
- **Invalid Filenames**: Some characters may not be valid for filesystem operations
160+
- **URL Encoding**: Special characters in aliases may require URL encoding in SCP URLs
39161

40-
<details>
41-
<summary>Management Port Binding</summary>
42162

43-
Case Number|Case Name|Store Path|Enrollment Params|Expected Results|Passed|Screenshots
44-
-------|----------|------------------|--------------------|----------------------------|----|--------
45-
TC10|Add New Cert and Bind to Mgmt Port|/home/ec2-user|**Alias**:<br>&lt;random&gt;<br>**Overwrite**:<br>true|Cert Installed and Bound|True|![](images/TC10.gif)
46-
TC11|Renew and Rebind Cert to Mgmt Port|/home/ec2-user|**Alias**:<br>&lt;same&gt;<br>**Overwrite**:<br>true|Cert Renewed and Bound Again|True|![](images/TC11.gif)
47-
TC13|Remove Mgmt Bound Cert|/home/ec2-user|**Alias**:<br>&lt;same&gt;<br>**Overwrite**:<br>false|Cert Removed, Binding Left Intact|True|![](images/TC13.gif)
48163

49-
</details>

0 commit comments

Comments
 (0)