puppetlabs-f5_rest::f5_clientsslprofile

A placeholder.

Debugging

Troubleshooting issues when APIs are involved can be painful. Now the advertised providers within this module can pass you useful debugging info when you append the debug argument to your puppet run:

puppet apply --debug

puppet agent --debug

This can be used in conjuntion with other arguments

Stack trace

To get a complete Ruby stack trace from your puppet run, use or append the following argument:

puppet apply --trace

puppet agent --trace

This can be used in conjuntion with other arguments

f5_clientsslprofile

Virtual server client-side proxy SSL profile configuration

Optional parameters

ensure

Add or remove the F5 Client SSL Profile

Values accepted: "present", "absent"

ensure       => present,

name

The client SSL profile name.

name         => 'Example Client SSL Profile',

alert_timeout

Specifies the maximum time period in seconds to keep the SSL sessionactive after alert message is sent. The default value is 10 seconds.

Values accepted: Integer

alert_timeout => 10,

allow_expired_crl

Use the specified Certificate Revocation Lists (CRL) file even if it has expired. end

allow_expired_crl => '???',

allow_non_ssl

Enables or disables non-SSL connections. Specify enabled when you want non-SSL connections to pass through the traffic management.

Values accepted: "enabled", "disabled"

allow_non_ssl => 'enabled',

authenticate

Specifies how often the system authenticates a user. The default value is once

Values accepted: "once"

authenticate  => 'once',

authenticate_depth

Specifies the authenticate depth. This is the client certificate chain maximum traversal depth. The default value is 9.

Values accepted: Integer

authenticate_depth => '9',

ca_file

Specifies the certificate authority (CA) file name. Configure certificate verification by specifying a list of client or server CAs that the traffic management system trusts. This is the 'Trusted Certificate Authorities' option in the UI.

ca_file => '/Common/f5-irule.crt',

cache_size

Specifies the SSL session cache size. For client-side profiles only, you can configure timeout and size values for the SSL session cache. Because each profile maintains a separate SSL session cache, you can configure the values on a per-profile basis. The default value is 262144.

Values accepted: Integer

cache_size => 10,

cache_timeout

Specifies the SSL session cache timeout value. This specifies the number of usable lifetime seconds of negotiated SSL session IDs. The default value is 3600 seconds. Acceptable values are integers greater than or equal to 0 and less than or equal to 86400.

Values accepted: Integer

cache_timeout => 10,

cert

This option is deprecated and is maintained here for backward compatibility reasons. Please check cert-key-chain option to add certificate, key, passphrase and chain to the profile.

Values accepted: Valid absolute path to certificate on F5 device

cert          => '/Common/default.crt',

cert_extension_includes

Specifies the extensions of the web server certificates to be included inthe generated certificates using SSL Forward Proxy. For example, {basic-constraints}. The default value is none.

Values accepted: Any of the values below in array form:

['authority-key-identifier', 'certificate-policies', 'crl-distribution-points', 'key-usage', 'subject-directory-attributes', 'subject-key-identifier', 'issuer-alternative-name', 'fresh-crl', 'extended-key-usage', 'basic-constraints', 'subject-alternative-name']

cert_extension_includes => ['basic-constraints', 'subject-alternative-name'],

cert_lifespan

Specifies the lifespan of the certificate generated using the SSL forward proxy feature. The default value is 30.

Values accepted: Integer

cert_lifespan               => '30',

cert_lookup_by_ipaddr_port

Specifies whether to perform certificate look up by IP address and port number.

Values accepted: "enabled", "disabled"

cert_lookup_by_ipaddr_port  => 'disabled',

ciphers

Specifies a cipher name. The default value is DEFAULT, which uses the default ciphers.

Values accepted: "DEFAULT"

ciphers                             => 'DEFAULT',

client_cert_ca

Specifies the client cert certificate authority name. This is the 'Advertised Certificate Authorities' option in the UI.

Values accepted: Valid absolute path to certificate on F5 device

client_cert_ca                      => '/Common/ca-bundle.crt',

default_profile

Specifies the profile that you want to use as the parent profile. Your new profile inherits all settings and values from the parent profile specified.

default_profile                     => '/Common/clientssl',

description

User defined description.

description => 'This is an example description',

destination_ip_blacklist

Specifies the data group name of destination ip blacklist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

destination_ip_blacklist            => '/Common/private_net',

destination_ip_whitelist

Specifies the data group name of destination ip whitelist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

destination_ip_whitelist            => '/Common/private_net',

forward_proxy_bypass_default_action

Specifies the SSL forward proxy bypass default action. The default option is intercept."

Values accepted: "intercept"

forward_proxy_bypass_default_action => 'intercept',

generic_alert

Enables or disables generic-alert. The default option is enabled, which causes the SSL profile to use generic alert number. Conversely, you can specify disabled to cause SSL profile to use alert number defined in RFC5246/RFC6066 strictly.

Values accepted: "enabled", "disabled"

generic_alert                       => 'enabled',

handshake_timeout

Specifies the handshake timeout in seconds. This setting specifies the maximum number of seconds that a connection can be idle after the capabilities exchange request was sent to the server. The default value is 10. The system will reset the connection after it has timed out. You can specify a numeric value in the range 0 to 4294967295. The recommended value is in the range of 5 to 30.

Values accepted: Integer

handshake_timeout                   => '10',

hostname_blacklist

Specifies the data group name of hostname blacklist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

hostname_blacklist                  => '/Common/images',

hostname_whitelist

Specifies the data group name of hostname whitelist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

hostname_whitelist                  => '/Common/images',

inherit_certkeychain

Enables or disables the inheritance of certificates within the chain.

Values accepted: "true", "false"

inherit_certkeychain                => 'true',

key

This option is deprecated and is maintained here for backward compatibility reasons. Please check cert-key-chain option to add certificate, key, passphrase and chain to the profile.

Values accepted: Absolute path to key on F5 device

key                                 => '/Common/default.key',

max_renegotiations_per_minute

Specifies the maximum number of renegotiation attempts allowed in aminute. The default value is 5.

Values accepted: Integer

max_renegotiations_per_minute       => '5',

mod_ssl_methods

Enables or disables ModSSL method emulation. Enable this option when OpenSSL methods are inadequate, for example, when you want to use SSL compression over TLSv1. The default value is disabled.

Values accepted: "enabled", "disabled"

mod_ssl_methods                     => 'disabled',

mode

Specifies the profile mode, which enables or disables SSL processing. The default value isenabled.

Values accepted: "enabled", "disabled"

mode                                => 'enabled',

tm_options

Traffic Management Options. Must supply options in an array.

Values accepted: Any of the values below in array form:

['netscape-reuse-cipher-change-bug', 'microsoft-big-sslv3-buffer', 'msie-sslv2-rsa-padding', 'ssleay-080-client-dh-bug', 'tls-d5-bug', 'tls-block-padding-bug', 'dont-insert-empty-fragments', 'no-ssl', 'no-dtls', 'no-session-resumption-on-renegotiation', 'no-tlsv1.1', 'no-tlsv1.2', 'no-tls', 'single-dh-use', 'ephemeral-rsa', 'cipher-server-preference', 'tls-rollback-bug', 'no-sslv2', 'no-sslv3', 'no-tlsv1', 'pkcs1-check-1', 'pkcs1-check-2', 'netscape-ca-dn-bug', 'netscape-demo-cipher-change-bug']

tm_options                          => ['netscape-reuse-cipher-change-bug', 'microsoft-big-sslv3-buffer', 'msie-sslv2-rsa-padding', 'ssleay-080-client-dh-bug', 'tls-d5-bug', 'tls-block-padding-bug', 'dont-insert-empty-fragments', 'netscape-ca-dn-bug', 'netscape-demo-cipher-change-bug'],

peer_cert_mode

Specifies the peer certificate mode. The default value is ignore.

Values accepted: "ignore", "require", "request"

peer_cert_mode                      => 'request',

peer_no_renegotiate_timeout

Specifies the number of seconds that the system waits for ClientHello before sending Fatal Alert after sending Hello Request. The default is 10 seconds. You can set it to Indefinite which specifies that the system continue to wait for ClientHello for an unlimited time.

Values accepted: "indefinite", Integer

peer_no_renegotiate_timeout         => 'indefinite',

proxy_ca_cert

Specifies the Certification Authority cert for SSL Forward Proxy.

Values accepted: Absolute path to certificate on F5 device

proxy_ca_cert          => '/Common/proxy_ca.crt',

proxy_ca_key

Specifies the Certification Authority key for SSL Forward Proxy.

Values accepted: Absolute path to key on F5 device

proxy_ca_key          => '/Common/proxy_ca.key',

proxy_ca_passphrase

Specifies the passphrase of the Certification Authority key for SSL Forward Proxy.

Values accepted: String

proxy_ca_passphrase = 'super_secret_passphrase',

proxy_ssl

Enabling this option requires a corresponding client ssl profile with proxy-ssl enabled to perform transparent SSL decryption. This feature allows further modification of application traffic within an SSL tunnel while still allowing the server to perform necessary authorization, authentication, auditing steps.

Values accepted: "enabled", "disabled"

proxy_ssl                           => 'disabled',

proxy_ssl_passthrough

Enabling this option requires a corresponding client ssl profile with proxy-ssl-passthrough enabled. This allows Proxy SSL to pass through the traffic when cipher suite negotiated between the client and server is not supported. The default option is disabled.

Values accepted: "enabled", "disabled"

proxy_ssl_passthrough               => 'disabled',

renegotiate_max_record_delay

Specifies the maximum number of SSL records that the traffic management system can receive before it renegotiates an SSL session. After the system receives this number of SSL records, it closes the connection. This setting applies to client-side profiles only. The default value is 10.

Values accepted: "indefinite", Integer

renegotiate_max_record_delay        => 'indefinite',

renegotiate_period

Specifies the number of seconds from the initial connect time after which the system renegotiates an SSL session. The default value is indefinite, which means that you do not want the system to renegotiate SSL sessions. Each time the session renegotiation is successful, a new connection is started. Therefore, the system attempts to renegotiate the session again,in the specified amount of time following a successful session renegotiation. For example, setting the renegotiate-period option to 3600 seconds triggers session renegotiation at least once an hour.

Values accepted: "indefinite", Integer

renegotiate_period                  => 'indefinite',

renegotiate_size

Specifies a throughput size, in megabytes, of SSL renegotiation. This option forces the traffic management system to renegotiate an SSL session based on the size, in megabytes, of application data that is transmitted over the secure channel. The default value is indefinite, which specifies that you do not want a throughput size."

Values accepted: "indefinite", Integer

renegotiate_size                    => 'indefinite',

renegotiation

Specifies whether renegotiations are enabled. The default value is enabled. When renegotiations are disabled, the system is acting as an SSL server, and a COMPAT or NATIVE cipher is negotiated, the system will abort the connection. Additionally, when renegotiations are disabled and the system is acting as an SSL client, the system will ignore the Hello Request messages from the server.

Values accepted: "enabled", "disabled"

renegotiation                       => 'enabled',

retain_certificate

APM module requires storing certificate in SSL session. When set to false, certificate will not be stored in SSL session. The default value is true.

Values accepted: "true", "false"

retain_certificate                  => 'true',

secure_renegotiation

Specifies the secure renegotiation mode. The default value is require-strict. When secure renegotiation is set to require, any connection to an unpatched server will be aborted. For server-ssl, there is no difference between require and require-strict secure renegotiation. When secure renegotiation is set to request, connections to unpatched servers will be permitted. This setting is NOT recommended however, as it is subject to active man-in-the-middle attacks.

Values accepted: "required", "preferred", "disabled"

secure_renegotiation                => 'require',

server_name

Name matched to TLS/1.1 and above client SSL requests that support the Server Name Indication extension. The default value is empty, which disables support for this extension.

server_name => "lb_server.example.vm",

session_mirroring

Enables or disables session mirroring to the high-availability peer. The default option is disabled.

Values accepted: "enabled", "disabled"

session_mirroring                   => 'disabled',

session_ticket, :parent => Puppet::Property::F5truthy) do

Enables or disables session-ticket. The default option is disabled, which causes the SSL profile not to use session ticket per RFC 5077. Conversely, you can specify enabled to cause SSL profile to use session ticket per RFC 5077.

Values accepted: "enabled", "disabled"

session_ticket                      => 'enabled',

session_ticket_timeout

Specifies the session ticket timeout. The default value is 0.

Values accepted: Integer

session_ticket_timeout              => '15',

sni_default

When true, this profile is the default SSL profile when the server name in a client connection does not match any configured server names, or a client connection does not specify any server name at all."

Values accepted: "true", "false"

sni_default                         => 'false',

sni_require

When this option is enabled, connections to a server that does not support SNI extension will be rejected.

Values accepted: "true", "false"

sni_require                         => 'false',

source_ip_blacklist

Specifies the data group name of source ip blacklist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

source_ip_blacklist                 => '/Common/private_net',

source_ip_whitelist

Specifies the data group name of source ip whitelist when SSL forward proxy bypass feature is enabled.

Values accepted: Absolute path to list on F5 device

source_ip_whitelist                 => '/Common/private_net',

ssl_forward_proxy

Enables or disables ssl-forward-proxy feature. The default option is disabled. Conversely, you can specify enabled to use the SSL Forward Proxy Feature.

Values accepted: "enabled", "disabled"

ssl_forward_proxy                   => 'disabled',

ssl_forward_proxy_bypass

Enables or disables ssl-forward-proxy-bypass feature. The default option is disabled. Conversely, you can specify enabled to use the SSL Forward Proxy Bypass Feature."

Values accepted: "enabled", "disabled"

ssl_forward_proxy_bypass            => 'enabled',

ssl_sign_hash

Specifies SSL sign hash algorithm which is used to sign and verify SSL Server Key Exchange and Certificate Verify messages for the specified SSL profiles. The default value is sha1."

Values accepted: "any"

ssl_sign_hash                       => 'any',

strict_resume

Enables or disables the resumption of SSL sessions after an unclean shutdown. The default value is disabled, which indicates that the SSL profile refuses to resume SSL sessions after an unclean shutdown.

Values accepted: "enabled", "disabled"

strict_resume    => 'disabled',

unclean_shutdown

Specifies, when enabled, that the SSL profile performs unclean shutdowns of all SSL connections, which means that underlying TCP connections are closed without exchanging the required SSL shutdown alerts. If you want to force the SSL profile to perform a clean shutdown of all SSL connections, you can disable this option.

Values accepted: "enabled", "disabled"

unclean_shutdown => 'enabled',

cert_key_chain

Adds, deletes, or replaces a set of certificate, key, passphrase, chain and OCSP Stapling Parameters object. client-sslprofile requires at least onecert/keypair to work." # This has to be handled as an array should be.

Values accepted: An array containing three hashes with the following keys: 'name', 'cert', 'key'

cert_key_chain   => [{'cert' => '/Common/default.crt', 'key' => '/Common/default.key', 'name' => 'default'}],

A f5_clientsslprofile example

A full example pulled from puppet resource on the included profile /Common/wom-default-clientssl by F5.

f5_clientsslprofile { '/Common/wom-default-clientssl':
  ensure                              => 'present',
  alert_timeout                       => '10',
  allow_non_ssl                       => 'enabled',
  authenticate                        => 'once',
  authenticate_depth                  => '9',
  cache_size                          => '262144',
  cache_timeout                       => '3600',
  cert                                => '/Common/default.crt',
  cert_extension_includes             => ['basic-constraints', 'subject-alternative-name'],
  cert_key_chain                      => [{'cert' => '/Common/default.crt', 'key' => '/Common/default.key', 'name' => 'default'}],
  cert_lifespan                       => '30',
  cert_lookup_by_ipaddr_port          => 'disabled',
  ciphers                             => 'DEFAULT',
  default_profile                     => '/Common/clientssl',
  forward_proxy_bypass_default_action => 'intercept',
  generic_alert                       => 'enabled',
  handshake_timeout                   => '10',
  inherit_certkeychain                => 'false',
  key                                 => '/Common/default.key',
  max_renegotiations_per_minute       => '5',
  mod_ssl_methods                     => 'disabled',
  mode                                => 'enabled',
  peer_cert_mode                      => 'ignore',
  peer_no_renegotiate_timeout         => '10',
  proxy_ssl                           => 'disabled',
  proxy_ssl_passthrough               => 'disabled',
  renegotiate_max_record_delay        => 'indefinite',
  renegotiate_period                  => 'indefinite',
  renegotiate_size                    => 'indefinite',
  renegotiation                       => 'enabled',
  retain_certificate                  => 'true',
  secure_renegotiation                => 'require',
  session_mirroring                   => 'disabled',
  session_ticket                      => 'disabled',
  sni_default                         => 'false',
  sni_require                         => 'false',
  ssl_forward_proxy                   => 'disabled',
  ssl_forward_proxy_bypass            => 'disabled',
  ssl_sign_hash                       => 'any',
  strict_resume                       => 'disabled',
  tm_options                          => ['dont-insert-empty-fragments'],
  unclean_shutdown                    => 'enabled',
}

abrader/f5_clientsslprofile_README.md

puppetlabs-f5_rest::f5_clientsslprofile

Debugging

Stack trace

f5_clientsslprofile

Optional parameters

ensure

name

alert_timeout

allow_expired_crl

allow_non_ssl

authenticate

authenticate_depth

ca_file

cache_size

cache_timeout

cert

cert_extension_includes

cert_lifespan

cert_lookup_by_ipaddr_port

ciphers

client_cert_ca

default_profile

description

destination_ip_blacklist

destination_ip_whitelist

forward_proxy_bypass_default_action

generic_alert

handshake_timeout

hostname_blacklist

hostname_whitelist

inherit_certkeychain

key

max_renegotiations_per_minute

mod_ssl_methods

mode

tm_options

peer_cert_mode

peer_no_renegotiate_timeout

proxy_ca_cert

proxy_ca_key

proxy_ca_passphrase

proxy_ssl

proxy_ssl_passthrough

renegotiate_max_record_delay

renegotiate_period

renegotiate_size

renegotiation

retain_certificate

secure_renegotiation

server_name

session_mirroring

session_ticket, :parent => Puppet::Property::F5truthy) do

session_ticket_timeout

sni_default

sni_require

source_ip_blacklist

source_ip_whitelist

ssl_forward_proxy

ssl_forward_proxy_bypass

ssl_sign_hash

strict_resume

unclean_shutdown

cert_key_chain

A f5_clientsslprofile example