Skip to content
F5 Distributed CloudCertificate Management
Aa

CDN server TLS

Prerequisites

Section titled “Prerequisites”

Install the latest Terraform and provider releases. Set the provider environment and keep private inputs and state outside Git. Copy this configuration into its own directory and state; never reuse another owner’s name.

Supply a reachable origin and an advertised CDN hostname. The CDN configuration requires an origin even when testing server TLS.

Configuration

Section titled “Configuration”

The JSON below shows the complete public configuration resulting from native encryption, with encoded public chains and encrypted-key placeholders. API defaults and provider provenance may add fields. Never apply encoded-material placeholders. HCL includes the complete canonical root; download its files separately.

Download JSON.

Download HCL files: main.tf · variables.tf · versions.tf.

Public JSON

Section titled “Public JSON”
[
  {
    "metadata": {
      "name": "<XCSH_LB_NAME>",
      "namespace": "<XCSH_NAMESPACE>",
      "description": "Native Terraform Blindfold certificate example",
      "labels": {
        "certificate-example": "terraform"
      }
    },
    "spec": {
      "domains": ["<XCSH_DOMAINNAME>"],
      "no_service_policies": {},
      "disable_waf": {},
      "disable_api_definition": {},
      "disable_api_discovery": {},
      "disable_rate_limit": {},
      "disable_ip_reputation": {},
      "disable_malicious_user_detection": {},
      "disable_client_side_defense": {},
      "disable_threat_mesh": {},
      "no_challenge": {},
      "system_default_timeouts": {},
      "user_id_client_ip": {},
      "default_sensitive_data_policy": {},
      "l7_ddos_action_default": {},
      "origin_pool": {
        "origin_request_timeout": "60s",
        "origin_servers": [
          {
            "port": 443,
            "public_name": {
              "dns_name": "<XCSH_ORIGIN_HOSTNAME>"
            }
          }
        ],
        "no_tls": {}
      },
      "https": {
        "tls_cert_options": {
          "tls_inline_params": {
            "no_mtls": {},
            "tls_config": {
              "default_security": {}
            },
            "tls_certificates": [
              {
                "certificate_url": "string:///<BASE64_PUBLIC_CHAIN>",
                "private_key": {
                  "blindfold_secret_info": {
                    "location": "string:///<ENCRYPTED_KEY>"
                  }
                }
              }
            ]
          }
        }
      }
    }
  }
]

Complete HCL

Section titled “Complete HCL”
resource "xcsh_cdn_loadbalancer" "example" {
  name                             = var.name
  namespace                        = data.xcsh_namespace.existing.name
  description                      = var.description
  labels                           = { certificate-example = "terraform" }
  domains                          = [var.domain]
  no_service_policies              = {}
  disable_waf                      = {}
  disable_api_definition           = {}
  disable_api_discovery            = {}
  disable_rate_limit               = {}
  disable_ip_reputation            = {}
  disable_malicious_user_detection = {}
  disable_client_side_defense      = {}
  disable_threat_mesh              = {}
  no_challenge                     = {}
  system_default_timeouts          = {}
  user_id_client_ip                = {}
  default_sensitive_data_policy    = {}
  l7_ddos_action_default           = {}
  origin_pool {
    origin_request_timeout = "60s"
    origin_servers {
      port = 443
      public_name {
        dns_name = var.origin_hostname
      }
    }
    no_tls = {}
  }
  https {
    tls_cert_options {
      tls_inline_params {
        no_mtls = {}
        tls_config {
          default_security = {}
        }
        tls_certificates {
          blindfold = { id = "server", certificate_file = var.certificate_file, private_key_file = var.private_key_file }
        }
      }
    }
  }
}
variable "namespace" {
  type        = string
  description = "Existing namespace; this configuration never owns it."
  default     = "demo-app"
}
variable "name" {
  type        = string
  description = "Unique name owned only by this Terraform state."
  default     = "example-tls"
}
variable "domain" {
  type        = string
  description = "Application hostname covered by the server certificate SAN."
  default     = "tls.example.com"
}
variable "certificate_file" {
  type        = string
  description = "Absolute path to a leaf-first PEM chain outside Git."
}
variable "private_key_file" {
  type        = string
  description = "Absolute path to the matching private PEM key outside Git."
}
variable "description" {
  type        = string
  description = "Operator-editable resource description."
  default     = "Native Terraform Blindfold certificate example"
}


data "xcsh_namespace" "existing" {
  name = var.namespace
}
variable "origin_hostname" {
  type        = string
  description = "Existing reachable origin hostname; certificate must allow clientAuth for mTLS."
}
terraform {
  required_version = null
  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0"
    }
  }
}


# XCSH_API_URL and XCSH_API_TOKEN configure the provider, without a CLI.
provider "xcsh" {}

Configure

Section titled “Configure”

Supply the prerequisite fields in Customize examples. Download the files and review the saved plan.

Terminal window
umask 077
configuration="$XCSH_WORKDIR/cdn-server-tls"
mkdir -p "$configuration"
export TF_VAR_namespace="$XCSH_NAMESPACE"
export TF_VAR_name="$XCSH_LB_NAME"
export TF_VAR_domain="$XCSH_DOMAINNAME"
export TF_VAR_certificate_file="$XCSH_CERT_FILE"
export TF_VAR_private_key_file="$XCSH_KEY_FILE"
export TF_VAR_origin_hostname="$XCSH_ORIGIN_HOSTNAME"
for file in main.tf variables.tf versions.tf; do
  curl --silent --show-error --fail "https://f5-sales-demo.github.io/certificate-management/_data/terraform/cdn-server-tls/$file" --output "$configuration/$file"
done
terraform -chdir="$configuration" init -upgrade
terraform -chdir="$configuration" validate
terraform -chdir="$configuration" plan -out=create.plan
terraform -chdir="$configuration" show create.plan
shasum -a 256 "$configuration/create.plan"

Confirm the resource names, references, and ownership in the plan. Apply that reviewed plan.

Terminal window
terraform -chdir="$configuration" apply create.plan

Expect the configured resource to be created with encrypted key material. A failed or uncertain apply requires named readback before recovery; create a fresh plan after reconciling state.

Verify

Section titled “Verify”

Read the complete API configuration privately and check the new process’s Terraform plan.

Terminal window
curl --silent --show-error --fail --header "Authorization: APIToken $XCSH_API_TOKEN" \
  "$XCSH_API_URL/api/config/namespaces/$XCSH_NAMESPACE/cdn_loadbalancers/$TF_VAR_name?response_format=2" \
  --output "$configuration/example-readback.json"
terraform -chdir="$configuration" plan -detailed-exitcode

Expect HTTP 200, the selected names and references, the encoded public chain, and private_key.blindfold_secret_info.location at every certificate node. No blindfold input or clear private key belongs in the API object. Expect exit 0 and No changes; exit 2 means changes and exit 1 means failure.

Configuration readback does not prove served TLS. Use the advertised consumer hostname for trusted TLS checks, then require its application’s expected response. Serving remains unqualified until a concrete consumer, advertisement, and traffic check are available.

Run these checks only after attaching an advertised HTTPS consumer on port 443 with this certificate. Expect trusted hostname verification, identical fingerprints, and the application’s expected status and response. A different protocol or port requires the corresponding consumer check.

Terminal window
openssl s_client -connect "$XCSH_DOMAINNAME:443" -servername "$XCSH_DOMAINNAME" -verify_hostname "$XCSH_DOMAINNAME" -verify_return_error -CAfile "$XCSH_CERT_FILE" -showcerts < /dev/null > "$configuration/served-handshake.pem"
openssl x509 -in "$XCSH_CERT_FILE" -noout -sha256 -fingerprint > "$configuration/expected-fingerprint"
openssl x509 -in "$configuration/served-handshake.pem" -noout -sha256 -fingerprint > "$configuration/served-fingerprint"
cmp "$configuration/expected-fingerprint" "$configuration/served-fingerprint"
curl --silent --show-error --fail --cacert "$XCSH_CERT_FILE" "https://$XCSH_DOMAINNAME/get" --output "$configuration/consumer-response" --write-out '%{http_code}\n'

Maintain

Section titled “Maintain”

Use input and lifecycle guidance for renewal, stable IDs, import, and recovery. Change both private files together, preserve the logical ID and referenced algorithm, review a fresh plan, apply, and repeat configuration and traffic verification.

Remove

Section titled “Remove”

Review and hash a destroy plan for this state. Remove dependent consumers first; the existing namespace is a data source.

Terminal window
terraform -chdir="$configuration" plan -destroy -out=remove.plan
terraform -chdir="$configuration" show remove.plan
shasum -a 256 "$configuration/remove.plan"
terraform -chdir="$configuration" apply remove.plan
terraform -chdir="$configuration" state list

Expect only this state’s resources to be removed and an empty resource list. Confirm typed API absence; authentication and transport failures do not establish absence.