lb ca

The lb ca command does two separate jobs. The first one is adding a trust anchor: saving a CA certificate that will be trusted while the certificate of the other side is being verified. The second one is creating an internal PKI CA: setting up an authority with which TR7 can create its own certificates and whose key stays on the device. Its panel equivalent is the Certificate Authorities (CA) screen.

The two are done with separate sub-commands: add only saves the certificate text, create creates or imports a key.

Command Summary

TR7 WEB-CLI · lb ca

# Tab after the command

admin@TR7LBWAF01> lb ca

add create delete list show update

 

admin@TR7LBWAF01> lb ca list # list all of them

admin@TR7LBWAF01> lb ca show <id> # show one

admin@TR7LBWAF01> lb ca add name <name> … # add a trust anchor

admin@TR7LBWAF01> lb ca create name <name> mode <mode> caType <type> # internal CA

admin@TR7LBWAF01> lb ca update id <id> … # change

admin@TR7LBWAF01> lb ca delete <id> # delete

admin@TR7LBWAF01>  

The Two Record Types

	lb ca add	lb ca create
What it does	Adds an existing CA certificate among the trusted ones	Creates a CA whose key stays on the device
The key	None; only the certificate text is kept	It is created or imported
Can it create certificates	No	Yes
Where it is used	In verifying the certificate of the other side	In signing its own certificates and in verification
The required fields	name	name · mode · caType

Both sub-commands write to the same collection; list and show show the two together.

lb ca add — The Trust Anchor

Step 1 Write the name

lb ca add name org-root-ca

Step 2 Give the certificate text

--content "-----BEGIN CERTIFICATE----- …"

Field	Status	What it does	What is written after it
name	Required	Gives a name to the record; it is unique in the collection	The name of the record
--content	Optional	Keeps the CA certificate that will be trusted	The PEM text. Since it contains line breaks and spaces, it is written inside double quotes

The fields derived from the certificate are not written

The three fields below appear in the completion list but are defined as read-only in the schema: their values are written by the server while the certificate is being parsed; writing them by hand is not an expected use.

Field	What it does	What is written after it
--certDnsNames.N	Holds the DNS names that the certificate covers	The server fills it in; it is not written by hand
--infoArr.N	Holds the additional key details parsed from the certificate	The server fills it in; it is not written by hand
--certEku.N	Holds the extended key usage of the certificate	The server fills it in; it is not written by hand

lb ca create — The Internal PKI CA

Step 1 Write the name

lb ca create name org-issuing-ca

Step 2 Select the creation mode

mode generate · enroll · import

Step 3 Select the CA type

caType root or issuing

Step 4 Add the fields according to the type and the mode

In an intermediate CA the usage area, in an import the PEM texts are asked for.

The Required Fields

Order	Field	Status	Value
1	name	Required	The name of the CA
2	mode	Required	generate · enroll · import (default generate)
3	caType	Required	root · issuing (default root)

The Creation Modes

mode	Panel equivalent	What it does
generate	Generate (self-managed hierarchy)	Creates the key and the certificate on the device; it sets up a self-managed hierarchy
enroll	Enroll under an external CA (CSR)	Creates the key and a CA-qualified certificate request (CSR) on the device; the request is signed by an external parent CA. The record is completed when the signed certificate is pasted in the interface
import	Import existing pair	Imports an existing CA certificate and key pair

The CA Types

caType	Panel equivalent	Meaning
root	Root CA	The self-signing authority at the top of the chain
issuing	Issuing CA	The intermediate authority bound to a parent CA that actually signs the certificates

The Fields

Field	Status	What it does	What is written after it
--usage	Conditional	Determines which kind of certificates the intermediate CA will sign	server the server certificates (default) · client the client certificates. It opens only while caType issuing and is expected to be given in an intermediate CA
--parentCaId	Conditional	Selects which parent CA will sign the intermediate CA	An existing CA record. It opens only while caType issuing; it is expected to be given while an intermediate CA is being created with mode generate
--subjectCn	Optional	Determines the subject name of the certificate	The Common Name value
--subjectO	Optional	Writes the name of the organization	The Organization value
--subjectOu	Optional	Writes the name of the unit	The Organizational Unit value
--subjectC	Optional	Writes the country code	A two-letter country code, for example TR
--keyAlgo	Optional	Selects the algorithm of the key to be created	rsa2048 · rsa3072 · rsa4096 (default) · ecP256 · ecP384
--lifetimeDays	Optional	Determines for how many days the certificate will be valid	The number of days
--pathLen	Optional	Limits how many more levels of CA there can be under this CA	The chain depth
--certContent	Conditional	Carries the CA certificate to be imported	The PEM text; it opens only while mode import
--keyContent	Conditional	Carries the private key to be imported	The PEM text; it opens only while mode import. It is kept encrypted in the record
--keyPassphrase	Conditional	Gives the password of the imported key	The password of the key; it opens only while mode import

Examples

TR7 WEB-CLI · A) Adding a trust anchor

# the trusted CA for verifying the certificate of the other side

admin@TR7LBWAF01> lb ca add name org-root-ca --content "<pem-text>"

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) Creating a root CA

admin@TR7LBWAF01> lb ca create name org-root mode generate caType root \

--subjectCn "Kurum Root CA" --subjectO "Kurum" --subjectC TR \

--keyAlgo rsa4096 --lifetimeDays 3650 --pathLen 1

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) An intermediate CA under the root CA

# the intermediate CA that will do the signing; the parent CA and the usage area are given

admin@TR7LBWAF01> lb ca create name org-issuing mode generate caType issuing \

--parentCaId <root-ca> --usage server --subjectCn "Kurum Issuing CA" --lifetimeDays 1825

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) Enrolling under an external CA and importing

# the key and the CSR are created on the device; the signed certificate is pasted in the interface afterwards

admin@TR7LBWAF01> lb ca create name externally-signed mode enroll caType issuing \

--usage client --subjectCn "Kurum Client CA"

 

# an existing CA pair is imported

admin@TR7LBWAF01> lb ca create name old-ca mode import caType root \

--certContent "<certificate-pem>" --keyContent "<key-pem>" --keyPassphrase <password>

admin@TR7LBWAF01>  

Usage Locations

The created record is selected in the fields that ask for verification:

Where	Field
The verification of the backend certificate	lb backend and lb backend-group → --sslVerifyCa
The server certificate in the health check	lb hc → --tlsVerifyCa
The verification of the visitor certificate	The lb ssl-security profiles

Updating and Deleting

TR7 WEB-CLI · update and delete

# in an update only the name and the certificate text can be changed

admin@TR7LBWAF01> lb ca update id <id> --name new-name

admin@TR7LBWAF01> lb ca update id <id> --content "<new-pem>"

 

admin@TR7LBWAF01> lb ca delete <id>

admin@TR7LBWAF01>  

In the update command only --name, --content and the read-only fields derived from the certificate are listed. The CA type, the usage area, the parent CA and the key information are not present in an update: these are determined while the record is being created.

Things to Know

• add and create write to the same list. Both stay in the same collection; in the list output the trust anchors and the internal CAs appear together.
• An intermediate CA is not set up on its own. When caType issuing is selected, the usage area is stated; if it is being created with mode generate, the parent CA is given as well.
• Enrolling is two steps. mode enroll creates only the key and the certificate request; the record waits until the certificate signed by the external CA is pasted in the interface.
• The PEM texts require quotes. Since the certificate and key texts contain line breaks and spaces, they are written inside double quotes.
• The key is kept encrypted. The imported private key is kept encrypted in the record.