Create a Radware Cloud WAF machine¶

Create a Radware Cloud WAF machine so Certificate Manager - SaaS can discover the Transport Layer Security (TLS) certificates in a Radware Cloud WAF account and install renewed certificates on the applications that the account protects. Certificate Manager - SaaS connects to the Radware Cloud Services API directly with an API key, so you don't need a VSatellite.

To create a Radware Cloud WAF machine¶

1. Sign in to Certificate Manager - SaaS.
2. Click Installations > Machines.
3. Click New, and then select Radware Cloud WAF.
4. On the Properties step, in Name, enter a name for the machine.
5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

6. In Application Protection ID (Tenant ID), enter the Application Protection ID of your account.

   Note

   Use the Application Protection ID, not the Infrastructure Protection ID, and not the account ID that's embedded in the API key. A wrong ID makes Test Access fail.

7. For Credential Type, choose how to provide the credentials:

   • Enter Credentials to enter the credentials in the next step. This is the default.
   • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

   Note

   Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

8. If you chose Enter Credentials, in API Key, enter the API key that you created in the Radware Cloud Portal. If you chose Select Credentials, the stored credential's password is used as the API key.

   Note

   Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

9. (Optional) For Certificate Cleanup, choose whether Certificate Manager - SaaS removes old certificates from your Radware account after it provisions a new one:

   • Off: Certificate Manager - SaaS never deletes certificates. This is the default.
   • Report only (delete nothing): Certificate Manager - SaaS logs the certificates that Delete would remove, and deletes nothing.
   • Delete: After Certificate Manager - SaaS confirms that an application serves the new certificate, it deletes up to five expired certificates that no application uses and that cover the application's main domain.

   Warning

   The cleanup can't tell certificates that Certificate Manager - SaaS uploaded from certificates that someone else uploaded. It deletes any certificate that meets its rules, including one that someone uploaded for a different host. A certificate qualifies if its common name (CN) or any of its subject alternative names (SANs) covers the application's main domain, so a wildcard or multi-domain certificate can qualify. For example, renewing www.example.com can delete an expired, unused *.example.com certificate that someone uploaded for api.example.com. A deleted certificate can't be recovered. Choose Report only (delete nothing) first, review what it reports, and then switch to Delete.

10. (Optional) In Cleanup After Expiry (Days), enter the number of days a certificate must have been expired before the cleanup can delete it. The default is 30, and you can enter 1 to 3650. It's used only when Certificate Cleanup is Report only (delete nothing) or Delete.

    Note

    • The cleanup runs only when a provisioning assigns a new certificate to an application and Certificate Manager - SaaS confirms that the application serves it. It doesn't run when you provision a certificate that the application already serves, or when a provisioning fails. Until the next provisioning that assigns a new certificate, Report only (delete nothing) reports nothing, and switching to Delete has no effect. Each run stops after 30 seconds.
    • The cleanup doesn't delete a certificate that any application uses, the certificate the application served before this provisioning, or a certificate that's still within the waiting period. A replaced certificate therefore stays in Radware for the rest of its validity plus this number of days, and a later renewal for the same domain removes it.
    • The cleanup is skipped while any application in the account uses an SNI certificate group.
    • The cleanup never changes the result of a provisioning. Certificates it doesn't remove stay in Radware until you delete them in the Cloud Portal.

11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    The test checks the API key, the Application Protection ID, and permission to read certificates and applications. It doesn't check the permission to download, upload, assign, or delete certificates. A key that can't download certificates passes the test, but every discovery fails. A missing upload or assign permission shows up during the first provisioning. If the test fails, check the API key, its expiration date, and the Application Protection ID.

12. (Optional) To skip certificates that have already expired, enable Exclude expired certificates.

    Discovery reports each certificate in the Radware account, with the applications that use it. Each HTTPS service of an application (its main domain and front port) becomes an installation. A certificate that no application uses is reported once, as (unbound). Discovery supports up to 16,383 certificates in an account. If the account has more, every discovery fails with an error that says failed to spool the certificate list, and nothing is discovered. Expired certificates don't count toward the limit when Exclude expired certificates is enabled, so enabling it can bring the account under the limit.

13. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

14. Click Continue. The Provisioning step opens.

15. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

16. Click Finish.

What's next?¶

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates in your Radware account.