- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
F5 Setup
This section covers the prerequisites for the F5 Orchestrator host and the F5 devices, the steps to install, register, and validate the F5 Orchestrator, and a technical reference for administrators.
Supported Targets
| Item | Supported |
|---|---|
| Appliance | F5 BIG-IP LTM (Local Traffic Manager) |
| Objects renewed | Client SSL profiles (client-ssl), each certificate-key-chain entry separately, and Server SSL profiles (server-ssl), in all partitions |
| Not renewed | Profiles owned by an iApp application service, profiles with no certificate, and profiles that use /Common/default.crt |
| Number of devices | Any number of devices per F5 Orchestrator |
| Number of F5 Orchestrators | One per CertSecure environment |
F5 Orchestrator Host Requirements
The F5 Orchestrator runs as a Windows service on a host in your network.
- A Windows Server host (Windows Server 2016 or later).
- A dedicated service account. The account needs full control only over the installation directory and the local rights Log on as a service and Log on as a batch job.
- Outbound HTTPS access (TCP, on the port the backend is running) to the CertSecure Manager backend.
- Outbound SSH access (TCP 22) to the management address of every F5 device.
Good to know:
- The F5 Orchestrator keeps its encryption key in the Windows Credential Manager of the account that registers it. Register the agent as the same account that runs the service.
F5 Requirements
- SSH access. TCP 22 must be reachable from the agent host to the F5 management address.
- An account with Advanced shell (bash) access and administrator-level rights. The F5 Orchestrator runs tmsh commands through bash, so the account's terminal access must be Advanced shell; with tmsh as the login shell, every sync fails. In every partition it works in, the account needs rights to read profiles and certificates, to create and delete crypto keys, CSRs, and certificates, to install certificates, to modify client-ssl and server-ssl profiles, and to save the configuration. In practice, this means an administrator-level account with access to all partitions. A reduced-privilege role may not work properly.
- The SSL profiles already exist. CertSecure finds the profiles and certificate-key-chain entries that are on the device; it does not create profiles or entries. For a push, the partition must already exist.
- High availability. If you run a device group (an HA pair or a cluster), onboard one unit by its management address. With Automatic Sync enabled on the device group, the F5's own config-sync carries the change to the other units after tmsh save sys config runs, so nothing extra is needed for the other units.
CertSecure Requirements
- Your license must include F5 Automation. Without it, the F5 tile is disabled.
- Your user account needs the Manage Renewal Agents permission. It is needed for every F5 page, including viewing devices, profiles, and tasks.
- For each profile you manage, a Certificate Authority, a Template, and an owner email address. The F5 integration offers DigiCert and Microsoft CA (MSCA) authorities. For DigiCert, an Organization ID and an Order Validity are also required. If the template has a minimum key size, RSA keys smaller than that are raised to it at renewal.
Installation and Registration
- Download the installer. Go to Utilities > Integrations > Load Balancers, click the F5 tile, and click Download.
- Extract the package to a folder on the F5 Orchestrator host, for example C:\EC_F5_Orchestrator. Make sure the service account has full control over this folder.
- Open conf.ini in the folder and set the CertSecure backend address under [CERTSECURE]. Use the same address you use in the browser. The agent does not start if this value is empty. The remaining values are optional and are described in the Configuration File table.
-
Install the service. Open an administrator Command Prompt in the agent folder and run:
EC_F5_RA.exe --username "DOMAIN\ServiceUser" --password "YourPassword" install - In CertSecure, go to Utilities > Integrations > Load Balancers and click Registration Token to generate a one-time token.
-
Register the agent. Open a Command Prompt as the service account (the same account used in the previous step), go to the agent folder, and run:
EC_F5_RA.exe debug - When prompted, paste the registration token and press Enter. Wait for the message F5 Orchestrator registered successfully, and then press Ctrl+C to leave debug mode.
- Start the service. Open services.msc, select EC_F5_Orchestrator, and click Start. The agent shows as Online in CertSecure Manager within about 60 seconds.
Configuration File
| Section | Key | Default | Description |
|---|---|---|---|
| [CERTSECURE] | HOSTNAME_OR_IP | (empty) | Required. Hostname or IP address of the CertSecure backend. |
| [CONFIG] | EXPIRY_CHECK_CYCLE | 12 | Hours between automatic syncs of each device. |
| [CONFIG] | RENEW_IF_EXPIRING_IN | 15 | Days before expiry at which a managed profile with Automation on is renewed automatically. |
| [CONFIG] | CA_ISSUE_TIMEOUT_MINUTES | 5 | Minutes to wait for the CA to issue each certificate (1 to 60). If the CA takes longer, the renewal of that profile is marked as failed. |
| [LOGGING] | LOGDIR | logs | Folder for the agent log. A relative path is resolved from the agent folder. |
| [LOGGING] | MAXSIZE_BYTES | 100000000 | Size at which the log file rotates. |
| [LOGGING] | NUM_BACKUP | 10 | Number of rotated log files kept. |
Restart the EC_F5_Orchestrator service after changing conf.ini.
Validation
- Go to Utilities > Integrations > Load Balancers.
- Confirm that the F5 Orchestrator is listed with the Status Online.
- Add an F5 device (see Adding an F5 Device in the UI Guide). Its first sync starts automatically.
- Right-click the device and choose View Tasks. Confirm that the F5 Device Sync task completed, and that Manage SSL Profiles lists the profiles found on the device under Staged Profiles.
Objects Created on the F5
Each renewal or push creates new objects in the profile's partition (or in the partition chosen for a push), named <common name>_<YYYY-MM-DD_HH-MM-SS>_UTC, for example www_example_com_2026-10-13_09-41-07_UTC.
| Object | Name | Notes |
|---|---|---|
| Key | <name> | Created on the F5; it never leaves it. |
| Certificate | <name> | Same name as the key, so the F5 pairs them. |
| Chain | <name>_chain | The intermediate CA certificates. Not created when Push Trust Chain is off, or when the CA's response has no intermediates; the profile then keeps its current chain. |
Good to know:
The previous certificate, key, and chain are never deleted. They stay on the F5 so that you can roll back.