Oracle Cloud Load Balancer¶

Use this procedure to provision a certificate from Certificate Manager - SaaS to an Oracle Cloud load balancer.

OCI doesn't let you change a certificate bundle after it's uploaded. To renew a certificate, Certificate Manager - SaaS uploads it to the load balancer as a new certificate bundle, moves every listener that used the old bundle to the new one, and then deletes the old bundle.

1. Sign in to Certificate Manager - SaaS.

2. Click Installations > Machines.

3. Click the more options button at the right end of the Oracle Cloud Load Balancer machine's row, and then select Provision.

4. In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.

   Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.

5. Under Certificate Information, enter the Load Balancer OCID. This is the OCID of the load balancer, and it starts with ocid1.loadbalancer..

6. (Optional) Enter the Load Balancer Name. This is the display name of the load balancer. After provisioning, Certificate Manager - SaaS replaces this value with the load balancer's display name from OCI. This name isn't part of the installation's identity, so renaming the load balancer in OCI doesn't create a new installation.

7. Leave Certificate Bundle Name empty.

   Certificate Manager - SaaS generates a new, unique name for every certificate it uploads and replaces any value you enter. The name is the certificate's common name in lowercase, with any character other than a letter, digit, hyphen, or underscore replaced by an underscore, capped at 64 characters, and followed by a hyphen and the first 12 characters of the certificate's SHA-256 fingerprint. If the certificate has no common name, Certificate Manager - SaaS uses its first DNS subject alternative name, or cert if it has none. For example, a certificate for www.example.com is uploaded as www_example_com-3f9a1c07b2e4.

8. Under Installation Endpoint, enter the Listener Name of a listener that serves the certificate you want to replace.

   Certificate Manager - SaaS moves this listener and every other listener that uses the same certificate bundle to the new certificate.

   Note

   If you leave Listener Name empty or enter <unbound>, Certificate Manager - SaaS uploads the certificate without moving any listener, and the previous certificate bundle stays on the load balancer. Discovery uses <unbound> for a certificate bundle that no listener uses.

9. (Optional) To save without pushing the certificate now, turn off Push certificate on save. It's on by default.

10. Click Save.

    Tip

    You can schedule your provisions daily, weekly, or monthly. See Provision certificates.

After saving, Certificate Manager - SaaS uploads the certificate as a new certificate bundle and moves each listener that used the old bundle to it, one listener at a time. Each listener keeps its other settings, such as its protocols, cipher suite, and hostnames. When no listener or backend set uses the old bundle anymore, Certificate Manager - SaaS deletes it. OCI applies each change as a work request, and Certificate Manager - SaaS waits for each one to finish before it starts the next. An installation record is created on the Installations tab.