Package: certbot-bigip
certbot-bigipRequirementssee certbot rquirements:https://certbot.eff.org/docs/install.html#system-requirementsF5The LetsEncrypt Chain needs to be at /Common/chain_Letsencrypt and in every other partition that uses this plugin. ( f.e.: /Partition/chain_Letsencrypt)
At the moment, the plugin checks if a corresponding certificate/chain is located in the same partition/folder as the clientssl profile that uses it.clientssl profile needs to be attached to the virtual server manually(DOMAIN_clientssl). At the moment, the plugin only updates the client profile but does not attach it to the virtual server.F5 SW version 14.x and higherInstallpip install certbot-bigipby installing the plugin you will also install all missing dependencies including certbot.Supported Featuresverifies the domain via HTTP01 (challenge verification implemented through an iRule)Partitions and iAppsStandalone and HA setups (Active/Standby, Active/Active)Creates the clientssl profile and attaches the certificate, key and chainDoes not modify the clientssl profile if it already existsSupports APM enabled virtual serversUsageParameters:--bigip-listCSVlistofBIG-IPsystemhostnamesoraddresses,allhavetobeinthesamecluster--bigip-usernameBIG-IPusername(commontoalllistedBIG-IPsystems)--bigip-passwordBIG-IPpassword(commontoalllistedBIG-IPsystems)--bigip-partitionBIG-IPpartition(commontoalllistedBIG-IPsystems)--bigip-clientssl-parentClientSSLparentprofiletoinheritdefaultvaluesfrom--bigip-vs-listCSVlistofBIG-IPvirtualservernames,optionallyincludingpartition--bigip-device-groupDeviceGrouptosyncroniseconfiguration--bigip-iappBIG-IPiApp(commontoalllistedBIG-IPsystems)--bigip-apmIstheVSAPMenabledornotExample:certbot--non-interactive--expand--email'admin@example.com'--agree-tos\-abigip-ibigip\-d'example.com'\--bigip-list'example-f5.local,example-f5-ha.local'\--bigip-username'user'\--bigip-password'secret'\--bigip-partition'internal'\--bigip-clientssl-parent'/Common/parent_clientssl'\--bigip-vs-list'/internal/example.com.app/example.com_vs'\--bigip-device-group'fail-sync'\--bigip-iapp'/internal/example.com.app/example.com'If the installation of a certificate during acertbot renewcommand somehow fails, certbot will not try to install the new certificate on a later run.
You can implement a check if the local certificate matches the remote certificate and if not issue acertbot install --cert-name example.comcommand.certbotrenewif!/usr/local/bin/cert-test.sh--quietexample.comthenecho$(date)echo"installing example.com"certbotinstall--cert-name'example.com'fiAlternatevly you can split the commands and not use the renew functionality like this:certbotcertonly--non-interactive--expand--email'admin@example.com'--agree-tos\-abigip-ibigip\-d'example.com'\--bigip-list'example-f5.local,example-f5-ha.local'\--bigip-username'user'\--bigip-password'secret'\--bigip-partition'internal'\--bigip-clientssl-parent'/Common/parent_clientssl'\--bigip-vs-list'/internal/example.com.app/example.com_vs'\--bigip-device-group'fail-sync'\--bigip-iapp'/internal/example.com.app/example.com_vs'if!/usr/local/bin/cert-test.sh--quietexample.comthenecho$(date)echo"installing example.com"certbot--non-interactive--expand--email'admin@example.com'--agree-tos\-abigip-ibigip\-d'example.com'\--bigip-list'example-f5.local,example-f5-ha.local'\--bigip-username'user'\--bigip-password'secret'\--bigip-partition'internal'\--bigip-clientssl-parent'/Common/parent_clientssl'\--bigip-vs-list'/internal/example.com.app/example.com_vs'\--bigip-device-group'fail-sync'\--bigip-iapp'/internal/example.com.app/example.com_vs'elseecho$(date)echo"not installing example.com"fiThe first call only validates and renews the certificate throughcertonlyparameter and thecert-test.shcompares the local certificate to the certificate delivered by the F5. If these don't match the second certbot call will skip the validation (as the certificate got already renewed) and install the certificate onto the F5.Testing:warning: Currently only integration tests are supported. Therefore a bigip is needed. To run integrations tests with other plugins for example the bluecat plugin you also need a bluecat in place.PrerequisitesConnection to the bigip under test from the machine running the testsclientssl profile needs to be attached to the virtual server manually(DOMAIN_clientssl). At the moment, the plugin only updates the client profile but does not attach it to the virtual server.Configure the tests using the following environment variables:ENVdefaultExampleBIGIP_EMAILtest@test.testBIGIP_USERNAMEuserBIGIP_PASSWORDsecretBIGIP_LISTexample-f5.local,example-f5-ha.localBIGIP_PARTITIONinternalBIGIP_CLIENTSSL_PARENT/Common/parent_clientsslBIGIP_VS_LIST/internal/example.com.app/example.com_vsBIGIP_DEVICE_GROUPfail-syncfail-syncBIGIP_IAPP/internal/example.com.app/example.comBIGIP_CUSTOM_PARTITIONCommonCommonBIGIP_CUSTOM_VS_LIST/Common/example.com.app/example1.com_vs, /Common/example.com.app/example2.com_vsrunning the testspython setup.py testContributingIf you find errors please open a new issue.Open a pull request if you have made changes you want to add. we will take a look at it and try our best to merge it. Your help is very welcomed.