Technology partner · Application delivery
F5 BIG-IP
Certificate lifecycle management for your F5® BIG-IP® Local Traffic Manager™ (LTM) estate, without ever breaking production. PKIFactor complements the F5® Application Delivery and Security Platform (ADSP): F5 ADSP delivers and secures applications, PKIFactor governs the certificate lifecycle behind them.
Validated live on BIG-IP VE 17.5.1.8, HA pair. The F5 BIG-IP connector is included in all PKIFactor editions.
Integration
Nature of the integration
PKIFactor discovers what your BIG-IP appliances actually serve, decides whether a write is safe, and deploys certificates, with the private key born on the appliance or its HSM, across client-ssl, server-ssl and forward-proxy CA profiles, from any issuing CA behind one policy.
What PKIFactor does on BIG-IP
- Reads virtual servers, client-ssl and server-ssl profiles and the served certificates (serial, SPKI): read-only discovery
- Installs certificate, key and chain objects and repoints the SSL profile, inside an iControl transaction
- Generates the key and the CSR on the appliance (software, on-board FIPS or network HSM custody)
- Saves the configuration (save sys config) and triggers config-sync to the device group
- Reads TLS options and cipher strings of client-ssl profiles for posture
What it does not do
- Does not create, modify or delete virtual servers
- Does not write the trust store (ca-file) of server-ssl profiles: inventory and grading only
- Does not touch iRules, AS3 declarations or iApps
- Never overwrites a profile owned by AS3 or an iApp, nor one serving a foreign or drifted certificate, without an explicit, audited adopt
- Never writes on a standby unit: follows the active member of the pair, refuses when the active peer is unreachable
Architecture
How it connects
CLM
PKIFactor CLM
- Multi-CA issuance and policy
- Safe-deployment orchestrator
- Crypto inventory (CBOM)
- Audit and RBAC
One policy across
private and public CAs
iControl REST, agentless
SOAP for least-privilege installs
read-only, matched by serial and SPKI
Appliance
F5 BIG-IP
- client-ssl · server-ssl · forward-proxy CA
- HA pair, active member followed
Hitless rotation in one transaction,
configuration saved and synced
Key on device
on-board FIPS or network HSM (PKCS#11)
keys are born and stay here
Schematic uses text labels only. REST-first: iControl REST to the management plane. iControl SOAP only for least-privilege installs and the CSR and SPKI read-back.
How it works
Five stages, from estate discovery to signed attestation
Each stage reads the appliance before acting on it. Nothing moves without a live read, a policy decision and an audit record.
Stage 1
Discover
Virtual server, SSL profile, served certificate: the estate as it is, read-only.
- Match by normalised serial, then SPKI
- Onboarding by issuing CA in five buckets: managed, foreign, unverified, self-signed, unknown
- Reconcile-all is a dry run by default, zero writes until confirmed
Stage 2
Judge
A pure policy engine picks the one safe action from a live risk preflight.
- Blast radius, SNI-shared VIP, inherited certificate
- Certificate owner, key custody, RBAC scope, configuration ownership
- Skip, stage, deploy, rotate, hold or block
Stage 3
Govern
The people who own the appliance keep the last word.
- Daily digest of what moves within 7 days (90 for foreign CAs)
- Veto by pausing a binding, reason recorded
- Four-eyes issuance policy, per-team scope, audit on every write
Stage 4
Deploy
Versioned objects, one transaction, the profile repointed, then saved and synced.
- Key born on the appliance or its HSM, never exported
- Same-key rotation keeps the SPKI stable for pinned peers
- Active member followed on HA pairs
Stage 5
Attest
Posture per appliance, not only expiry dates.
- CBOM per appliance (CycloneDX 1.7)
- Minimum TLS version and weak-cipher verdict per client-ssl profile
- Signed posture attestation (ML-DSA-65) on the CLM side
Coverage
Three TLS roles on the appliance
Most tools stop at the server certificate. On BIG-IP, three certificate roles matter, and each has its own guardrail.
| Role | What the certificate is | Custody | Guardrail |
|---|---|---|---|
| client-ssl | Server certificate presented to inbound clients (certKeyChain) | Key on device or key pushed. Hitless rotation by versioned objects | Foreign or drifted incumbent protected. Greenfield /Common/default.crt recognised |
| server-ssl | Client certificate the BIG-IP presents for outbound mTLS to a backend or an external service. Fills the gap as public CAs drop the clientAuth EKU | Key on device or key pushed. The appliance signs the handshake, so the key must live on it | EKU check: a template that provably excludes clientAuth is refused. Trust store read-only, graded for posture |
| forward-proxy CA | Inspection CA the BIG-IP uses to forge per-site leaves for outbound TLS inspection (certKeyChain usage:CA + sslForwardProxy) | Key on device recommended. SERVER entry preserved on rotation | Refuses any certificate that is not a CA (basicConstraints CA:TRUE required) |
Safe orchestrator
Situation read on the appliance, decision taken
PKIFactor never deploys blindly. Before writing, it reads what the profile really serves and decides from the live state of the appliance, not from a database.
| Situation read on the appliance | Decision | Why |
|---|---|---|
| Profile serves a foreign certificate (another CA) | Block | a partner identity is never overwritten |
| Out-of-band drift (appliance differs from what PKIFactor deployed) | Hold | deliberate manual change or incident: alert, do not overwrite |
| FIPS or HSM key on the profile with key-pushed custody | Block | key not exportable, custody must be key on device |
| Service account outside the partition's RBAC scope | Block | the write would return 403 mid-transaction; said upfront |
| Profile owned by IaC (AS3 or iApp) | Block | an out-of-band write would be erased at the tool's next deployment |
| Shared VIP, SNI or inherited certificate | Stage | supervised cutover, blast radius wider than one profile |
| Fresh profile serving the placeholder /Common/default.crt | Deploy | greenfield recognised, first deployment allowed |
Adopt or reclaim is a deliberate, audited, one-shot action that lifts only the incumbent protection (Block foreign, Hold drift). Hard incompatibilities and topology safeties stay in force. The console only offers the actions the backend would accept.
Automation
One dial for the operator: automation level and key custody
Set per appliance, overridable per binding. The API keeps two internal fields, delivery mode and auto-renew, projected from the level you choose.
| Level | Key custody | What PKIFactor does | Renews at D-X on its own |
|---|---|---|---|
| Full auto | Key on device | Re-provisions the key and CSR on the appliance at D-X, gets it signed, installs and repoints. The re-provision is the go-live | Yes |
| Full auto | Key pushed | Issues, pushes certificate, key and chain, repoints, saves and syncs. Hands-off | Yes |
| Install | Key pushed | Issues and installs the renewed objects as staged, not active. The operator activates | Yes, staged |
| ACME (advanced) | Key on device | The appliance renews itself against PKIFactor's ACME endpoint. PKIFactor supervises: inventory, drift, digest | The appliance does |
| Provide | Key pushed | Nothing is written on the appliance. The renewed certificate is made available for pickup | No write |
Renewal and operations
Built for the day something goes wrong
Renewal engine
- Hourly D-X worker, default threshold D-30, clamped to a third of a short-lived certificate's lifetime
- Issuing-CA latency budget: public CAs fire 5 days earlier, local CAs sign synchronously
- Maintenance hour honoured, with a 2-day near-expiry grace that overrides the window
- Failure memory with exponential backoff from 1 hour to 24 hours. An already-issued renewal is redeployed, not reissued
- Persisted deployment jobs: an orphaned job after a restart is replayed at the next tick, up to 5 attempts
- Notice recipients (pinned peers, mTLS partners) are warned ahead and can veto. They never receive a private key
Operations security
- resource-admin service account with SOAP install: the full cycle without file transfer and without the Administrator role on that path
- Partition-scope probe at test-connection: an account broader than the partition it writes to is flagged
- Follows the active member when the configured host is standby. Refuses when the active peer is unreachable or the device group is not in sync
- iControl transaction with rollback on the REST path. SOAP-imported objects rolled back if the repoint fails
- save sys config after every commit, then config-sync and a convergence wait. Non-convergence is warned, never ignored
- Audit trail on every write: actor, resource, action, outcome, and the reason where one is given. No secret is ever logged
Scope
Prerequisites, limits and maturity, stated plainly
- Validated on BIG-IP VE 17.5.1.8. CSR on device over REST needs BIG-IP 14.1 or later.
- Management-plane reachability over HTTPS 443, management certificate verified or pinned.
- iControl SOAP enabled for least-privilege installs, the CSR read-back and the served-certificate SPKI.
- FIPS or network HSM custody requires the FIPS or External-HSM module licensed and active on the appliance.
- The trust store of server-ssl profiles is read-only: PKIFactor inventories and grades the CA bundle, it does not write it.
- Post-quantum: PKIFactor prepares the migration on the CLM side, with the crypto inventory (CBOM) and a dual-certificate strategy. Serving post-quantum certificates on BIG-IP depends on platform support.
Proven live on F5
Estate discovery, dry-run reconciliation and foreign-certificate onboarding. Key-on-device provisioning with software custody and REST CSR. resource-admin with SOAP install. server-ssl and forward-proxy CA deployments. Hitless rotation. Active-member following on an HA pair. Posture: minimum TLS, weak ciphers, CBOM.
Written and unit-tested, gated on hardware
On-board FIPS and network HSM custody: the HSM partition is seen from the VE, end-to-end key generation awaits a hardware appliance. HA config-sync across a multi-member device group beyond a lab pair.
Resources
Read more
Solution brief · 2 pages
PKIFactor for F5 BIG-IP
Positioning, the problem, what PKIFactor does, four verifiable capabilities.
Datasheet · 5 pages
Connector datasheet
Does and does not, three TLS roles, automation and custody model, safe orchestrator, operations security.
Deployment guide · 10 pages
Illustrated deployment guide
Screen-by-screen walkthrough captured live on a BIG-IP VE HA pair.
30-minute demo on your BIG-IP pair
Discovery of your estate, one hitless rotation, one refused write. On your appliances, with a resource-admin account.
F5, BIG-IP, Local Traffic Manager, and iControl are trademarks, service marks, or trade names of F5, Inc., in the U.S. and other countries. PKIFactor is a product of ZetaCert.