How to change Certificate on F5 BIG-IP

Learn how to manually replace an SSL/TLS certificate on F5 BIG-IP, update Client SSL profiles, synchronize an HA device group, and verify virtual servers.

BIG-IP stores certificates and private keys as named objects. A Client SSL profile selects a certificate/key chain, and a virtual server references the profile. Replacing an object under the same name can preserve profile references; importing a new name requires updating every applicable profile.

Before you begin

Record the partition, certificate/key object names, Client SSL profiles, SNI/default profile roles, virtual servers, traffic group, and device-group sync status. Back up the configuration and obtain a PEM certificate/full chain plus matching private key, or an archive format supported by the current BIG-IP release.

Step-by-step certificate replacement

In the Configuration utility, go to System > Certificate Management > Traffic Certificate Management > SSL Certificate List > Import.
Import the certificate. To preserve references, select Overwrite Existing and the existing non-system certificate name. Import the matching key with the corresponding key object name. Confirm the chain/bundle object is present.
If using a new name, open each custom Client SSL profile and update its certificate key chain. Preserve RSA/ECDSA chains, SNI default settings, and partition paths.
Save the running configuration. In a DSC Sync-Failover group, synchronize the configuration to the intended device group and verify peers; do not assume an uploaded file on one unit is available on the other until sync succeeds.
For a multi-device service, fail traffic over or drain/update devices according to the HA runbook.

Product-specific considerations

Never overwrite a built-in default certificate name. A profile can carry separate RSA and ECDSA chains, and SNI can select another profile than the one first visible on the virtual server. Replacing the management GUI certificate is a different workflow from traffic certificates.

Verify the new certificate

Inspect the certificate/key object and profile association, then connect to every virtual server hostname with SNI. Verify both active and standby devices and check config-sync status and LTM logs.

Rollback

Overwrite the named objects with the saved old certificate/key or restore the profile's old chain, then sync the device group. Verify traffic before deleting the new objects.

Common problems

Certificate and key were imported under different object names.
Client SSL profile still references the old objects.
Config sync failed or the change was made in the wrong partition.
SNI default/other certificate chain masks the tested change.

Automating certificate replacement with aethercert

The aethercert F5 BIG-IP target uploads and creates or updates named certificate and key objects through iControl REST. When a Client SSL profile is configured on the target, it updates that profile to reference them.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.