Skip to content

Commit 6d102db

Browse files
author
Keyfactor
committed
Update generated docs
1 parent 30c4312 commit 6d102db

File tree

1 file changed

+109
-141
lines changed

1 file changed

+109
-141
lines changed

‎README.md‎

Lines changed: 109 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,6 @@ Uses A10's native REST API (AXAPI) for direct certificate management:
5858
- Automatically detects and handles template bindings and virtual service configurations
5959
- Implements intelligent certificate replacement to avoid service disruption
6060

61-
#### ThunderMgmt Store Type
62-
Uses SCP (Secure Copy Protocol) for management interface certificates:
63-
- Orchestrator uploads certificates to an intermediate Linux SCP server
64-
- A10 appliance retrieves certificates from the SCP server via API calls
65-
- Designed for management interface SSL certificate deployment
66-
6761
#### A10 vThunder Requirements
6862
- A10 vThunder appliance with AXAPI support
6963
- API versions 4.x or 6.x supported (automatically detected)
@@ -177,6 +171,64 @@ This guide explains how to create a user on A10 vThunder for API (AXAPI) access
177171
exit
178172
```
179173

174+
##### ThunderSsl Aliases
175+
176+
In the ThunderSsl store type, the **alias** directly corresponds to the certificate and private key names stored on the A10 appliance:
177+
178+
- **Certificate Name**: The alias becomes the SSL certificate identifier in A10's certificate store
179+
- **Private Key Name**: The same alias is used for the associated private key
180+
- **Template References**: SSL templates reference certificates by this exact alias name
181+
- **API Operations**: All A10 API calls use this alias to identify the certificate/key pair
182+
183+
###### Example ThunderSsl Usage
184+
```
185+
Alias: "webserver-prod-2025"
186+
→ A10 Certificate: "webserver-prod-2025"
187+
→ A10 Private Key: "webserver-prod-2025"
188+
→ Template Reference: server-ssl template uses cert "webserver-prod-2025"
189+
```
190+
191+
###### Alias Renaming for Template-Bound Certificates
192+
193+
When replacing a certificate that's bound to SSL templates, the orchestrator uses an intelligent renaming strategy:
194+
195+
1. **Timestamp Generation**: Creates a Unix timestamp (10 digits)
196+
2. **Alias Pattern Matching**:
197+
- If alias contains existing timestamp: `webserver-prod_1640995200` → `webserver-prod_1672531200`
198+
- If no timestamp found: `webserver-prod` → `webserver-prod_1672531200`
199+
3. **Length Validation**: Ensures final alias stays within A10's 240-character limit
200+
4. **Template Updates**: All SSL templates are updated to reference the new timestamped alias
201+
5. **Cleanup**: Original certificate is removed after successful template updates
202+
203+
###### Replacement Workflow Example
204+
```
205+
Original: "api-gateway-cert"
206+
Step 1: Generate new alias → "api-gateway-cert_1672531200"
207+
Step 2: Upload certificate with new alias
208+
Step 3: Update server-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
209+
Step 4: Update client-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
210+
Step 5: Remove old certificate "api-gateway-cert"
211+
Step 6: Rebind templates to virtual services
212+
```
213+
214+
###### Alias Best Practices
215+
- Use descriptive names that indicate purpose: `web-frontend-ssl`, `api-backend-tls`
216+
- Avoid special characters that might conflict with A10 naming rules
217+
- Consider including environment indicators: `prod-web-cert`, `stage-api-cert`
218+
- Remember that renaming will append timestamps for template-bound certificates
219+
220+
###### Character Limitations
221+
- **Maximum Length**: 240 characters (enforced by orchestrator)
222+
- **Recommended Characters**: Letters, numbers, hyphens, underscores
223+
- **Avoid**: Special characters that might cause issues in API calls or file operations
224+
225+
##### Troubleshooting Alias Issues
226+
227+
###### ThunderSsl Common Issues
228+
- **Template Update Failures**: Verify templates exist and are accessible
229+
- **Long Alias Names**: Orchestrator will truncate to fit timestamp if needed
230+
- **Special Characters**: May cause API call failures
231+
180232
##### Notes
181233

182234
- This user will now be able to authenticate and perform actions via A10's AXAPI (v2/v3) interface.
@@ -379,6 +431,57 @@ It may be possible to use the A10 device itself as the SCP target location if it
379431

380432
---
381433

434+
##### ThunderMgmt Aliases
435+
436+
In the ThunderMgmt store type, the **alias** determines the filename for certificates stored on the SCP server:
437+
438+
- **Certificate File**: `{alias}.crt` on the SCP server
439+
- **Private Key File**: `{alias}.key` on the SCP server
440+
- **A10 API Reference**: The A10 management interface loads certificates using SCP URLs pointing to these files
441+
442+
###### Example ThunderMgmt Usage
443+
```
444+
Alias: "mgmt-interface-cert"
445+
→ SCP Server Files:
446+
- /home/scpuser/mgmt-interface-cert.crt
447+
- /home/scpuser/mgmt-interface-cert.key
448+
→ A10 API Call:
449+
- Certificate URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.crt
450+
- Key URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.key
451+
```
452+
453+
###### For Alias Names
454+
- Use names that clearly identify the management purpose: `mgmt-interface-2025`
455+
- Ensure filenames are valid for both SCP server filesystem and A10 API calls
456+
- Consider including renewal dates: `mgmt-cert-jan2025`
457+
458+
###### ThunderMgmt File Management
459+
460+
The orchestrator handles file operations as follows:
461+
462+
1. **Add Operation**:
463+
- Uploads `{alias}.crt` and `{alias}.key` to SCP server
464+
- Calls A10 API to load certificate from SCP URLs
465+
- A10 device pulls files directly from SCP server
466+
467+
2. **Remove Operation**:
468+
- Deletes `{alias}.crt` and `{alias}.key` from SCP server
469+
- Does not modify A10 management interface configuration
470+
471+
3. **Replace Operation** (with Overwrite=true):
472+
- Overwrites existing `{alias}.crt` and `{alias}.key` files
473+
- Calls A10 API to reload certificate from same SCP URLs
474+
475+
###### Character Limitations
476+
- **Maximum Length**: 240 characters (enforced by orchestrator)
477+
- **Recommended Characters**: Letters, numbers, hyphens, underscores
478+
- **Avoid**: Special characters that might cause issues in API calls or file operations
479+
480+
###### ThunderMgmt Common Issues
481+
- **File Path Issues**: Ensure SCP user has access to the target directory
482+
- **Invalid Filenames**: Some characters may not be valid for filesystem operations
483+
- **URL Encoding**: Special characters in aliases may require URL encoding in SCP URLs
484+
382485
##### ✅ Summary
383486

384487
This extension coordinates certificate and private key delivery by using SCP as a bridge between orchestrator logic and A10's strict API requirements. It ensures secure and automated deployment for the management interface certificates with minimal manual intervention.
@@ -620,17 +723,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
620723

621724
<details><summary>A10 Thunder Management Certificates (ThunderMgmt)</summary>
622725

623-
### ⚙️ Configuration Fields
624-
625-
| Name | Display Name | Description | Type | Required |
626-
|-------------------|-------------------------------|--------------------------------------------------------------|--------|----------|
627-
| OrchToScpServerIp | Orch To Scp Server IP | IP from the orchestrator to the SCP Linux server | String | ✅ |
628-
| ScpPort | Port Used For SCP | Port used to connect to the SCP server | String | ✅ |
629-
| ScpUserName | Username Used For SCP | Username for SCP access on the Linux server | Secret | ✅ |
630-
| ScpPassword | Password Used For SCP | Password for SCP access on the Linux server | Secret | ✅ |
631-
| A10ToScpServerIp | A10 Device To SCP Server IP | IP used by the A10 device to reach the SCP server (can be private) | String | ✅ |
632-
| allowInvalidCert | Allow Invalid Cert on A10 API | If true, allows self-signed/untrusted certs for A10 API access | Bool | ✅ (default: true) |
633-
634726

635727
### Store Creation
636728

@@ -725,116 +817,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
725817

726818

727819

728-
## Certificate Alias Management
729-
730-
Understanding how aliases work is crucial for proper certificate management across both store types.
731-
732-
#### ThunderSsl Aliases
733-
734-
In the ThunderSsl store type, the **alias** directly corresponds to the certificate and private key names stored on the A10 appliance:
735-
736-
- **Certificate Name**: The alias becomes the SSL certificate identifier in A10's certificate store
737-
- **Private Key Name**: The same alias is used for the associated private key
738-
- **Template References**: SSL templates reference certificates by this exact alias name
739-
- **API Operations**: All A10 API calls use this alias to identify the certificate/key pair
740-
741-
##### Example ThunderSsl Usage
742-
```
743-
Alias: "webserver-prod-2025"
744-
→ A10 Certificate: "webserver-prod-2025"
745-
→ A10 Private Key: "webserver-prod-2025"
746-
→ Template Reference: server-ssl template uses cert "webserver-prod-2025"
747-
```
748-
749-
##### Alias Renaming for Template-Bound Certificates
750-
751-
When replacing a certificate that's bound to SSL templates, the orchestrator uses an intelligent renaming strategy:
752-
753-
1. **Timestamp Generation**: Creates a Unix timestamp (10 digits)
754-
2. **Alias Pattern Matching**:
755-
- If alias contains existing timestamp: `webserver-prod_1640995200` → `webserver-prod_1672531200`
756-
- If no timestamp found: `webserver-prod` → `webserver-prod_1672531200`
757-
3. **Length Validation**: Ensures final alias stays within A10's 240-character limit
758-
4. **Template Updates**: All SSL templates are updated to reference the new timestamped alias
759-
5. **Cleanup**: Original certificate is removed after successful template updates
760-
761-
##### Replacement Workflow Example
762-
```
763-
Original: "api-gateway-cert"
764-
Step 1: Generate new alias → "api-gateway-cert_1672531200"
765-
Step 2: Upload certificate with new alias
766-
Step 3: Update server-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
767-
Step 4: Update client-ssl templates: cert "api-gateway-cert" → "api-gateway-cert_1672531200"
768-
Step 5: Remove old certificate "api-gateway-cert"
769-
Step 6: Rebind templates to virtual services
770-
```
771-
772-
#### ThunderMgmt Aliases
773-
774-
In the ThunderMgmt store type, the **alias** determines the filename for certificates stored on the SCP server:
775-
776-
- **Certificate File**: `{alias}.crt` on the SCP server
777-
- **Private Key File**: `{alias}.key` on the SCP server
778-
- **A10 API Reference**: The A10 management interface loads certificates using SCP URLs pointing to these files
779-
780-
##### Example ThunderMgmt Usage
781-
```
782-
Alias: "mgmt-interface-cert"
783-
→ SCP Server Files:
784-
- /home/scpuser/mgmt-interface-cert.crt
785-
- /home/scpuser/mgmt-interface-cert.key
786-
→ A10 API Call:
787-
- Certificate URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.crt
788-
- Key URL: scp://scpuser:[email protected]:/home/scpuser/mgmt-interface-cert.key
789-
```
790-
791-
##### ThunderMgmt File Management
792-
793-
The orchestrator handles file operations as follows:
794-
795-
1. **Add Operation**:
796-
- Uploads `{alias}.crt` and `{alias}.key` to SCP server
797-
- Calls A10 API to load certificate from SCP URLs
798-
- A10 device pulls files directly from SCP server
799-
800-
2. **Remove Operation**:
801-
- Deletes `{alias}.crt` and `{alias}.key` from SCP server
802-
- Does not modify A10 management interface configuration
803-
804-
3. **Replace Operation** (with Overwrite=true):
805-
- Overwrites existing `{alias}.crt` and `{alias}.key` files
806-
- Calls A10 API to reload certificate from same SCP URLs
807-
808-
#### Alias Best Practices
809-
810-
##### For ThunderSsl
811-
- Use descriptive names that indicate purpose: `web-frontend-ssl`, `api-backend-tls`
812-
- Avoid special characters that might conflict with A10 naming rules
813-
- Consider including environment indicators: `prod-web-cert`, `stage-api-cert`
814-
- Remember that renaming will append timestamps for template-bound certificates
815-
816-
##### For ThunderMgmt
817-
- Use names that clearly identify the management purpose: `mgmt-interface-2025`
818-
- Ensure filenames are valid for both SCP server filesystem and A10 API calls
819-
- Consider including renewal dates: `mgmt-cert-jan2025`
820-
821-
##### Character Limitations
822-
- **Maximum Length**: 240 characters (enforced by orchestrator)
823-
- **Recommended Characters**: Letters, numbers, hyphens, underscores
824-
- **Avoid**: Special characters that might cause issues in API calls or file operations
825-
826-
#### Troubleshooting Alias Issues
827-
828-
##### ThunderSsl Common Issues
829-
- **Template Update Failures**: Verify templates exist and are accessible
830-
- **Long Alias Names**: Orchestrator will truncate to fit timestamp if needed
831-
- **Special Characters**: May cause API call failures
832-
833-
##### ThunderMgmt Common Issues
834-
- **File Path Issues**: Ensure SCP user has access to the target directory
835-
- **Invalid Filenames**: Some characters may not be valid for filesystem operations
836-
- **URL Encoding**: Special characters in aliases may require URL encoding in SCP URLs
837-
838820
## API Integration Details
839821

840822
### AXAPI Endpoints Used
@@ -847,13 +829,6 @@ The orchestrator handles file operations as follows:
847829
- **Partitions**: `/axapi/v3/active-partition`
848830
- **Memory Operations**: `/axapi/v3/write/memory`
849831

850-
### Certificate Format Support
851-
852-
- **PKCS#12**: Full support for certificates with private keys
853-
- **PEM**: Individual certificate files
854-
- **Certificate Chains**: Automatic handling of certificate chains
855-
- **Private Key Extraction**: Secure extraction and separate storage
856-
857832
### Advanced Features
858833

859834
#### Partition Support
@@ -877,13 +852,6 @@ Advanced virtual service management:
877852
- Coordinated unbinding and rebinding operations
878853
- Support for multiple template types on single ports
879854

880-
#### Alias Management
881-
882-
Sophisticated alias handling:
883-
- Automatic timestamp generation for replacements
884-
- 240-character limit compliance
885-
- Duplicate alias detection and resolution
886-
887855
### TEST CASES
888856

889857
Case Number|Case Name|Case Description|Store Path|Overwrite Flag|Alias Name|Expected Results|Passed

0 commit comments

Comments
 (0)