lb client-certificate

The lb client-certificate command manages the client certificates that TR7 presents while identifying itself to the other side. These certificates are used for mutual authentication (mTLS) in the backend connections and in the health checks. Its panel equivalent is the Client Certificates screen.

Command Summary

TR7 WEB-CLI · lb client-certificate

# Tab after the command

admin@TR7LBWAF01> lb client-certificate

add delete list show update

 

admin@TR7LBWAF01> lb client-certificate list # list all of them

admin@TR7LBWAF01> lb client-certificate show <id> # show one

admin@TR7LBWAF01> lb client-certificate add name <name> …

admin@TR7LBWAF01> lb client-certificate update id <id> …

admin@TR7LBWAF01> lb client-certificate delete <id>

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	Value
1	name	Required	The name of the record; it must be unique in the collection

There is no other required field in the add command; in the show and delete commands the id is written without the field name, and in the update command in the form id <id>.

Fields

Field	Status	What it does	What is written after it
name	Required	Gives a name to the certificate record	The name of the record; it must be unique in the collection
--intermediateCertProfile	Optional	Takes the intermediate certificate in the chain from a CA profile	The lb ca record
--extraIntermediateCertProfiles.N	Optional	Adds additional intermediate certificates to the chain	CA profile records; each with its own index
--rootCertProfile	Optional	Takes the root certificate in the chain from a CA profile	A CA profile record
--sanEmail.N	Optional	Determines the email addresses that the certificate will cover	An email address; each with its own index
--sanUpn.N	Optional	Determines the user principal names (UPN) that the certificate will cover	A UPN value; each with its own index
--allowDownload	Optional	Turns on the certificate being downloadable from the interface	true · false (default false)

Usage Locations

Where	Field
Identifying itself to the backend	lb backend and lb backend-group → --sslClientCert
Presenting credentials in the health check	lb hc → --tlsClientCert

Examples

TR7 WEB-CLI · the client certificate

admin@TR7LBWAF01> lb client-certificate add name tr7-client \

--intermediateCertProfile <intermediate-ca> --rootCertProfile <root-ca> \

--sanEmail.0 servis@kurum.com.tr --sanUpn.0 servis@kurum.local

 

# using it in the backend connection

admin@TR7LBWAF01> lb backend update id <backend> --sslService true --sslClientCert <certificate>

admin@TR7LBWAF01>  

Things to Know

• The direction should not be confused. These certificates are for TR7 identifying itself. The verification of the certificate of the visitor is the client certificate verification fields in the lb ssl-security profile.
• The chain comes from a profile or directly. The intermediate and root certificate are selected from a CA profile; when no profile is given, the chain can stay incomplete.
• The download permission is off. Unless --allowDownload is turned on, the certificate cannot be downloaded from the interface.
• The name is unique. A second record with the same name cannot be created.