Skip to content

Radware Cloud WAF

You can provision a certificate to an application that Radware Cloud WAF protects. Certificate Manager - SaaS uploads the certificate to your Radware account and assigns it to the application, which then serves it on all of its domains. Before you provision, check that:

  • The certificate's subject alternative names (SANs) cover the application's main domain. A wildcard name covers exactly one label, and the subject common name (CN) isn't checked. If the SANs don't cover the main domain, Certificate Manager - SaaS uploads the certificate but doesn't assign it.
  • The certificate is issued with its full intermediate chain. Certificate Manager - SaaS sends the chain in the order it receives it, and doesn't reorder it or add a root.

  • The application already exists in Radware Cloud WAF, and you have its application ID and its exact name.

  • Sign in to Certificate Manager - SaaS.

  • Click Installations > Machines.

  • Click the more options button at the right end of the Radware Cloud WAF machine's row, and then select Provision.

  • In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.

    Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.

  • Under Radware Certificate, leave Certificate Fingerprint as it is. The field is read-only. When Certificate Manager - SaaS installs the certificate, it fills in Radware's identifier for the certificate, its SHA-1 fingerprint.

  • Under Cloud WAF Application, in Application ID, enter the UUID of the Radware Cloud WAF application, in lowercase. The form accepts uppercase letters, but provisioning then fails, and the new certificate stays in your Radware account, unassigned.

  • In Application Name, enter the name of the application exactly as it appears in Radware. The name is case-sensitive.

    Note

    If the name doesn't match the application's name in Radware, provisioning fails, and the error message gives the correct name. The application keeps the certificate it serves, but the new certificate stays in your Radware account, unassigned. If the application already serves the new certificate, provisioning succeeds without checking the name.

  • To save without pushing the certificate, turn off Push certificate on save.

  • Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After you save, Certificate Manager - SaaS uploads the certificate, its chain, and its private key to your Radware account, unless the account already has the certificate. It then assigns the certificate to the application, and waits up to 60 seconds until the application serves it. An installation is created on the Installations tab.

Note

  • If the assignment fails or isn't confirmed in time, Certificate Manager - SaaS reports the provisioning as failed, and assigns the certificate that the application served before. The error message ends with the outcome:
    • The application was rolled back, or still serves the previous certificate. Radware can still apply the assignment late, so the application might serve the new certificate instead. Check which certificate it serves in the Radware Cloud Portal, or provision again.
    • The rollback failed. Assign the previous certificate to the application in the Radware Cloud Portal.
    • There's no previous certificate to roll back to. The application didn't serve a certificate before. Check which certificate it serves in the Radware Cloud Portal, or provision again.
  • If the application is still being provisioned in Radware, provisioning fails. The application keeps the certificate it serves, but the new certificate stays in your Radware account, unassigned. Try again after Radware finishes.
  • If the API key is invalid or expired, provisioning fails without changes, and nothing is rolled back. Create a new key in the Cloud Portal and update it on the machine.
  • Provisioning again is safe. If the application already serves the certificate, the provisioning succeeds without changes.

Note

The certificate that the application served before stays in your Radware account. So does a new certificate that wasn't assigned, for example because it didn't cover the application's main domain or the assignment was rolled back. These certificates are discovered as (unbound). Unless Certificate Cleanup removes them, delete them in the Radware Cloud Portal when you no longer need them. Before you delete a certificate, make sure that no application uses it and that it isn't the previous certificate you might need for a rollback. Radware refuses to delete a certificate for about 5 minutes after an assignment.

Note

If Radware rejects a certificate only because it doesn't chain to a publicly trusted root, for example a certificate from a private CA, Certificate Manager - SaaS uploads it again as a self-signed certificate. Radware then stores it without validating its chain, so a public certificate with a missing or misordered intermediate chain isn't caught.