6.5.12 A10 Thunder

Create an aXAPI admin, name the Client SSL templates, and add a deployment for each HA unit

CertKit has two A10 Thunder templates. Both run on a Windows agent and talk to the Thunder over aXAPI v3.

Template What it updates
A10 Thunder: Client SSL Template The certificate, key, and chain in the Client SSL templates you list. Virtual ports that use those templates serve the new certificate.
A10 Thunder: Management Web UI The certificate of the management interface, which serves both the web GUI and aXAPI.

Add the ones you use.

Requirements

  • The agent host must reach the Thunder’s management address over HTTPS. If aXAPI isn’t on port 443, include the port in A10 management IP/host and port, for example thunder.example.com:8443. A self-signed management certificate is fine.
  • Windows PowerShell 5.1 or later on the agent host. No extra modules are needed.
  • Both templates use the PEM (Cert + Key + Chain) format. Keep the format the template selects.
  • For an HA pair, add a deployment for each unit, each with that unit’s own management address.

Set up the admin account

Enter the account in A10 username and A10 password.

  • Client SSL Template: the admin needs write access to SSL certificates and keys and to Client SSL templates in the partition that holds the templates. A partition-scoped admin works.
  • Management Web UI: the admin needs global write privilege.

The account must be able to sign in to aXAPI with a username and password.

Client SSL template settings

Client SSL template name(s) lists the existing templates to update, separated by commas, for example app-ssl, portal-ssl. Each template must already exist. The template does not create Client SSL templates or attach them to virtual ports.

A10 partition defaults to shared and is hidden in the simple view. If your templates live in an L3V partition, change it in Advanced view. The template switches to that partition before it reads or changes anything, and saves only that partition.

Issue the certificate with the same key type, RSA or ECDSA, as the certificate it replaces. ACOS swaps a new certificate in for the default certificate of the same key type. With a different key type, ACOS adds the new certificate next to the old one. The template then tries to remove the old one, and logs a warning if ACOS won’t allow it.

What the Client SSL template does

On each run:

  1. Signs in to aXAPI, switches to the partition if it isn’t shared, and reads every listed template. If a template can’t be read, the run stops before anything changes.
  2. Uploads the key and certificate as certkit-<certificate ID>-<first 10 characters of the thumbprint>, and the intermediate chain with -chain added to that name.
  3. Works out what to replace in each template:
    • Default certificates and SNI server-name entries that hold an earlier CertKit upload of this certificate get the new files.
    • On the first deployment, nothing in the template is a CertKit upload yet, so the template’s default certificate is replaced. SNI server-name entries are left alone. Bind the certkit-* certificate in them once, and later renewals follow it.
    • If a template has more than one default certificate and none is a CertKit upload, the run stops. See Common problems.
  4. Updates each template, reads it back, and fails if the template doesn’t reference the new certificate. If a replaced certificate is still in the template because its key type was different, it is removed.
  5. Saves the configuration with write memory.
  6. Deletes older CertKit uploads of this certificate that nothing uses. Files still in use are kept and logged. Files CertKit didn’t upload are never deleted.
  7. Signs out.

Virtual ports that use the updated templates switch to the new certificate without a reload.

The template has no rollback. Files uploaded in step 2 stay on the Thunder if a later step fails. A failure during step 4 can leave some templates changed in the running configuration but not saved. Fix the cause and deploy again.

What the Management Web UI template does

On each run:

  1. Packages the certificate and chain as cert.pem and the key as key.pem in a zip file.
  2. Signs in to aXAPI, imports the zip as the management certificate, and signs out.
  3. Connects to the management address every 5 seconds for up to two minutes, and reports success once the Thunder serves the new certificate.

ACOS restarts its web service to load the certificate. Open GUI pages may need a refresh, and aXAPI is briefly unavailable while the service restarts.

Common problems

  • “a10Host, a10Username and a10Password must all be set”: fill in A10 management IP/host and port, A10 username, and A10 password.
  • “a10ClientSslTemplates is empty”: set Client SSL template name(s) to at least one template name.
  • “A10 POST /axapi/v3/auth failed”: the sign-in was rejected or the agent can’t reach aXAPI. Check the address, port, and credentials. The message includes the Thunder’s own error.
  • “A10 POST /axapi/v3/active-partition/… failed”: the partition in A10 partition doesn’t exist, or the account can’t use it.
  • “Could not read Client SSL template ‘…’ in partition ‘…’”: the template name doesn’t exist in that partition. Template names must match the Thunder exactly.
  • “Client SSL template ‘…’ has … default certificates and none is a CertKit upload of this certificate”: the template holds more than one default certificate, for example an RSA and an ECDSA pair, so CertKit can’t tell which to replace. In the A10 GUI, bind the uploaded certkit-* certificate named in the message in place of the one it replaces, then deploy again. Later renewals follow it.
  • “Client SSL template ‘…’ does not reference ‘…’ after the update”: ACOS accepted the change but the template doesn’t list the new certificate. Check the template in the GUI and confirm the account can change Client SSL templates.
  • “WARNING: … still also holds ‘…’, which has a different key type”: the new certificate was added next to the old one instead of replacing it. Remove the old certificate from the template by hand, and issue future renewals with the same key type.
  • “Kept cert-name ‘…’ (still used elsewhere)” or “Kept private-key ‘…’”: an older CertKit upload is still referenced by a template that isn’t in Client SSL template name(s). Add that template to the list, or remove the reference by hand.
  • “The management interface still serves certificate ‘…’ two minutes after the import”: the import went through but the Thunder didn’t start serving the new certificate in time. Check the certificate in the GUI. If the agent reaches the Thunder through a load balancer or NAT, make sure A10 management IP/host and port points at the Thunder itself.
  • HA unit still serves the old certificate: each unit needs its own deployment. Add one for the other unit’s management address.

For a product overview, see certificate automation for A10 Thunder.