sys crypto ca-bundle-manager¶

sys crypto ca-bundle-manager(1) BIG-IP TMSH Manual sys crypto ca-bundle-manager(1)

NAME
ca-bundle-manager - Certificate Authority (CA) certificate bundle manager on the BIG-IP(r) system.

MODULE
sys crypto

SYNTAX
A ca-bundle-manager manages cryptographic ca-bundles using the syntax given in the following sections.

CREATE/MODIFY
create ca-bundle-manager [name]
modify ca-bundle-manager [name]
options:
description [string]
exclude_bundle
[add | delete | replace-all-with] ] {
[cert file obj] ...
}
exclude_url
[add | delete | replace-all-with] ] {
[url] ...
}
include_bundle
[add | delete | replace-all-with] ] {
[cert file obj] ...
}
include_url
[add | delete | replace-all-with] ] {
[url] ...
}
proxy-server [ [hostname] | [ipv4] | [ipv6] ]
proxy-port [ port number ]
trusted-ca-bundle [certificate file object]
update-interval [days]
time-out [seconds]
update-now [yes | no]

LIST
list ca-bundle-manager [name]
options:
-hidden

DELETE
delete ca-bundle-manager [name]

DESCRIPTION
You can use the ca-bundle-manager component to automatically update and install CA-bundles on the system from
two sources - local certificate file objects and remote URL resources, using set include/exclude operations.
The set include/exclude operations are equivalent to mathematical set addition/subtraction operations. For
example, the user may use include-bundle and include-url options to combine CA-certificates from various
sources, and use exclude-bundle and exclude-url options to remove certain CA-certificates from the final CA-
bundle file. The generated CA-bundle file will be installed as a certificate-file-object on the system, and
used as trusted CA-bundle by other modules. Additionally, the user may set the update frequency of the CA-
bundle, or use web proxy for downloading the remote URL resources. By default, a newly created CA-bundle
manager does not create or update the managed CA-bundle object unless it has a positive update interval or
being explicitly told to do so by the update-now option. Additionally, the calculated CA-bundle must contain
at least two CA certificates to be installed on the system.

EXAMPLES
modify sys crypto ca-bundle-manager bmgr include-bundle add { ca-bundle.crt } include-url add {
https://ca.f5net.com/ca-bundle.crt } trusted-ca-bundle trusted-ca-chain.crt update-interval 30

Creates a ca-bundle-manager bmgr from two sources, one is a locally installed certificate file object
ca-bundle.crt, and the other is from remote URL resource https://ca.f5net.com/ca-bundle.crt using trusted CA
bundle . bmgr is refreshed from the two sources every 30 days.

modify sys crypto ca-bundle-manager bmgr update-now yes

Extending from above example, this command triggers an immediate update of the generated ca-bundle from its
sources.

list sys crypto ca-bundle-manager bmgr -hidden

Shows all the properties of the ca-bundle-manager bmgr, including the hidden fields.

delete sys crypto ca-bundle-manager bmgr

Deletes the ca-bundle-manager bmgr from the system. Note that the generated ca-bundle certificate file object
is not removed, and can still be used.

OPTIONS
description
Specifies user defined description.

include-bundle
Specifies a list of certificate file objects to include for generating the new ca-bundle.

include-url
Specifies a list of remote ca-bundles at the URLs to include for generating the new ca-bundle.

exclude-bundle
Specifies a list of certificate file objects to exclude from the new ca-bundle.

exclude-url
Specifies a list of remote ca-bundles at the URLs to exclude from the new ca-bundle.

partition Displays the administrative partition within which this ca-bundle-manager resides.
proxy-server Specifies the host name or IP address of the proxy server for accessing remote URL resources.
Only HTTP proxy is supported. Optional http:// may be prepended.
proxy-port Specifies the port number of the proxy server for accessing remote URL resources. Default is 3128.
trusted-ca-bundle
Specifies the trusted CA certificate bundle when downloading ca-bundles from the other URLs.

update-interval
Specifies the update interval in days to refresh the remote ca-bundles at the URLs. Default value is 0,
which means the generated ca-bundle is not dynamically updated.

time-out
Specifies the time-out period in seconds to download the remote ca-bundles at the URLs. The value ranges
between 1 and 3600 (1 hour). The default value is 8 seconds.

update-now
Specifies whether the ca-bundle-manager should immediately refresh its generated ca-bundle from all its
sources and recalculate its certificate contents. The default value is no.

updated-by
Specifies a read-only attribute from which this ca-bundle-manager was last updated.

managed-bundle
Specifies a read-only attribute, which indicates the ca-bundle certificate file object name, managed by
this ca-bundle-manager.

SEE ALSO
create, list, modify, delete, tmsh

COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

BIG-IP 2017-09-05 sys crypto ca-bundle-manager(1)