Skip to content

Create an A10 Thunder ADC machine

Create an A10 Thunder ADC machine so Certificate Manager - SaaS can discover the certificates in the client SSL templates of your virtual servers and provision certificates to them. Certificate Manager - SaaS connects to the device's aXAPI management interface through a VSatellite, and it supports devices that use partitions.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the A10 Thunder ADC on its management port.
  • An A10 Thunder ADC that runs Advanced Core Operating System (ACOS) 5.2.1 or later.
  • The hostname or IP address of the A10 Thunder ADC, and its management port if it isn't 443.
  • An A10 Thunder ADC administrator account that can access every partition you want to manage. To provision certificates, the account must also be able to save the configuration (write memory) in each of those partitions.

To create an A10 Thunder ADC machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select A10 Thunder ADC.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In Hostname or IP Address, enter the hostname or IP address of the A10 Thunder ADC.

  8. (Optional) In Port, enter the management port if it isn't 443. If you leave it empty, Certificate Manager - SaaS uses 443.

  9. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  10. If you chose Enter Credentials, enter the Username and Password of the A10 Thunder ADC administrator account. If you chose Select Credentials, the stored account needs the same access.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  11. (Optional) Select Enable Debug logging to have the connector write a detailed log for troubleshooting. It's off by default.

  12. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can sign in to the A10 Thunder ADC. On a device that uses partitions, the test also checks which partitions the account can access. A partition the account can't access doesn't fail the test. The list of accessible partitions is written to the debug log only when Enable Debug logging is selected.

  13. (Optional) To skip certificates that have already expired, select Exclude expired certificates.

  14. (Optional) In Partitions to discover, enter a comma-separated list of the partitions to discover. If you leave it empty, discovery scans the default shared partition and every other partition on the device.

    Discovery finds the certificates in the client SSL templates that are attached to virtual server ports, and it records the partition where it found each certificate. How discovery handles a partition it can't scan depends on this field:

    • If Partitions to discover is empty, discovery skips a partition the account can't access and continues with the others.
    • If you list partitions, discovery fails if a listed partition doesn't exist on the device or the account can't access it, so you can correct the list.

    Discovery also fails if it can't read the device's list of partitions at all, or can't list the virtual servers in the shared partition.

  15. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  16. Click Continue. The Provisioning step opens.

  17. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  18. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your virtual servers.