Skip to content

Commit ae44b9f

Browse files
bhillkeyfactorbhillkeyfactor
authored
Update thundermgmt.md
1 parent 4a92b30 commit ae44b9f

File tree

1 file changed

+89
-5
lines changed

1 file changed

+89
-5
lines changed

‎docsource/thundermgmt.md‎

Lines changed: 89 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,97 @@ When a user logs into the GUI via `https://<device_ip>`, the certificate present
1818

1919
## Requirements
2020

21-
TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
2221

23-
## Certificate Store Configuration
22+
### A10 Certificate Management Orchestrator Extension
2423

25-
TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
24+
This orchestrator extension automates the process of uploading, inventorying, and deploying SSL certificates from a Linux SCP server to an A10 vThunder device. Due to A10 API limitations, certificates must be pulled from the SCP server directly by the A10 device itself.
25+
26+
---
27+
28+
#### 📌 How It Works
29+
30+
1. **The orchestrator** connects to a Linux server via SCP to inventory available certificates.
31+
2. It stores relevant metadata and pushes new certificates and keys to the SCP server.
32+
3. It then instructs the **A10 device** to retrieve the certificate and private key from the Linux server using API calls.
33+
4. The A10 device loads the certificate and key directly from the SCP server for use on its **management interface**.
34+
35+
---
36+
37+
#### ⚙️ Configuration Fields
38+
39+
| Name | Display Name | Description | Type | Required |
40+
|-------------------|-------------------------------|--------------------------------------------------------------|--------|----------|
41+
| OrchToScpServerIp | Orch To Scp Server IP | IP from the orchestrator to the SCP Linux server | String | ✅ |
42+
| ScpPort | Port Used For SCP | Port used to connect to the SCP server | String | ✅ |
43+
| ScpUserName | Username Used For SCP | Username for SCP access on the Linux server | Secret | ✅ |
44+
| ScpPassword | Password Used For SCP | Password for SCP access on the Linux server | Secret | ✅ |
45+
| A10ToScpServerIp | A10 Device To SCP Server IP | IP used by the A10 device to reach the SCP server (can be private) | String | ✅ |
46+
| allowInvalidCert | Allow Invalid Cert on A10 API | If true, allows self-signed/untrusted certs for A10 API access | Bool | ✅ (default: true) |
47+
48+
---
49+
50+
#### 📡 API Call Example (From A10 Device)
51+
52+
```http
53+
POST /axapi/v3/web-service/secure/certificate
54+
```
55+
56+
**Payload:**
57+
```json
58+
{
59+
"certificate": {
60+
"load": 1,
61+
"file-url": "scp://ec2-user:[email protected]:/home/ec2-user/26125.crt"
62+
}
63+
}
64+
```
65+
66+
> A similar call is made for loading the private key onto the A10 device using a separate AXAPI endpoint.
67+
68+
- The A10 device **must have access** to the SCP server via the specified IP (`A10ToScpServerIp`).
69+
- Ensure the certificate and key file paths are correct and accessible to the SCP user.
70+
71+
---
72+
73+
#### 🔐 Linux Server Requirements
2674

27-
## Global Store Type Section
75+
##### User Access
76+
- The SCP user (`ScpUserName`, e.g., `ec2-user`) must:
77+
- Have SSH/SCP access.
78+
- Authenticate with a password.
79+
- Have **read and write** permissions in the SCP location.
2880

29-
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
81+
> New certificates and **private keys** are generated by Keyfactor and uploaded to this location by the orchestrator. Therefore, write access is essential.
82+
83+
##### SCP Directory Permissions
84+
- Ensure the directory (e.g., `/home/ec2-user/`) is:
85+
- Writable by the orchestrator (to upload new certs/keys).
86+
- Readable by both the orchestrator and the A10 device (via SCP).
87+
88+
---
89+
90+
#### 🔄 Alternate Design Consideration
91+
92+
It may be possible to use the A10 device itself as the SCP target location if it supports read/write SCP operations **outside the CLI context**. However, A10 devices typically restrict file access through CLI or API mechanisms only, and not through standard SCP server operations. This limitation is why a separate Linux SCP server is currently required.
93+
94+
---
95+
96+
#### 🔓 Network and Port Requirements
97+
98+
| Source | Destination | Port | Protocol | Purpose |
99+
|--------------------|---------------------|------|----------|-------------------------------|
100+
| Orchestrator | Linux SCP Server | 22 | TCP | Inventory and upload via SCP |
101+
| A10 Device | Linux SCP Server | 22 | TCP | Cert and key retrieval via SCP|
102+
| Orchestrator/Admin | A10 Device (API) | 443 | HTTPS | API calls to load certificate |
103+
104+
---
105+
106+
#### ✅ Summary
107+
108+
This extension coordinates certificate and private key delivery by using SCP as a bridge between orchestrator logic and A10's strict API requirements. It ensures secure and automated deployment for the management interface certificates with minimal manual intervention.
109+
110+
111+
## Certificate Store Configuration
112+
113+
TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
30114

0 commit comments

Comments
 (0)