Skip to content

Provision certificates to Radware Cloud WAF

Provision a certificate from Certificate Manager - SaaS to an application that Radware Cloud WAF protects. Certificate Manager - SaaS uploads the certificate to your Radware account and assigns it to the application, which then serves it on all of its domains.

Before you begin

  • A Radware Cloud WAF machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • A certificate whose subject alternative names (SANs) cover the application's main domain. A wildcard name covers exactly one label, and the subject common name (CN) isn't checked. If the SANs don't cover the main domain, Certificate Manager - SaaS uploads the certificate but doesn't assign it.
  • A certificate issued with its full intermediate chain. Certificate Manager - SaaS sends the chain in the order it receives it, and doesn't reorder it or add a root.
  • An application that already exists in Radware Cloud WAF, and its application ID and exact name.

To provision a certificate to Radware Cloud WAF

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, leave Certificate Fingerprint as it is. The field is read-only. When Certificate Manager - SaaS installs the certificate, it fills in Radware's identifier for the certificate, its SHA-1 fingerprint.

  6. Under Installation Endpoint, in Application ID, enter the UUID of the Radware Cloud WAF application, in lowercase. The form accepts uppercase letters, but provisioning then fails, and the new certificate stays in your Radware account, unassigned.

  7. In Application Name, enter the name of the application exactly as it appears in Radware. The name is case-sensitive.

    Note

    If the name doesn't match the application's name in Radware, provisioning fails, and the error message gives the correct name. The application keeps the certificate it serves, but the new certificate stays in your Radware account, unassigned. If the application already serves the new certificate, provisioning succeeds without checking the name.

  8. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  9. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS uploads the certificate, its chain, and its private key to your Radware account, unless the account already has the certificate. It then assigns the certificate to the application, and waits up to 60 seconds until the application serves it. An installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.

Note

  • If the assignment fails or isn't confirmed in time, Certificate Manager - SaaS reports the provisioning as failed, and assigns the certificate that the application served before. The error message ends with the outcome:
    • The application was rolled back, or still serves the previous certificate. Radware can still apply the assignment late, so the application might serve the new certificate instead. Check which certificate it serves in the Radware Cloud Portal, or provision again.
    • The rollback failed. Assign the previous certificate to the application in the Radware Cloud Portal.
    • There's no previous certificate to roll back to. The application didn't serve a certificate before. Check which certificate it serves in the Radware Cloud Portal, or provision again.
  • If the application is still being provisioned in Radware, provisioning fails. The application keeps the certificate it serves, but the new certificate stays in your Radware account, unassigned. Try again after Radware finishes.
  • If the API key is invalid or expired, provisioning fails without changes, and nothing is rolled back. Create a new key in the Cloud Portal and update it on the machine.
  • Provisioning again is safe. If the application already serves the certificate, the provisioning succeeds without changes.

Note

The certificate that the application served before stays in your Radware account. So does a new certificate that wasn't assigned, for example because it didn't cover the application's main domain or the assignment was rolled back. These certificates are discovered as (unbound). Unless Certificate Cleanup removes them, delete them in the Radware Cloud Portal when you no longer need them. Before you delete a certificate, make sure that no application uses it and that it isn't the previous certificate you might need for a rollback. Radware refuses to delete a certificate for about 5 minutes after an assignment.

Note

If Radware rejects a certificate only because it doesn't chain to a publicly trusted root, for example a certificate from a private CA, Certificate Manager - SaaS uploads it again as a self-signed certificate. Radware then stores it without validating its chain, so a public certificate with a missing or misordered intermediate chain isn't caught.