Can I create a CSR on TR7?

Short answer

Yes. The request is created in the CSR (External CA) tab of the Certificates & PKI → SSL/TLS Certificates screen; the private key is generated on TR7 or selected from the Private Key Library and does not leave the device. The CSR is downloaded with the Download the CSR operation of the request row and given to the CA; the certificate signed by the CA is uploaded to the same request with Upload the signed certificate. TR7 verifies that the certificate matches the key of the request and creates a new record in the certificate list that can be assigned to a vService. On renewal, the same CSR is re-signed and uploaded with Re-issue; the key and the vService assignments are preserved.

Problem: Getting a Certificate from a Corporate or Commercial CA Without Moving the Private Key

A certificate signing request (CSR) is required to get a certificate from a corporate or commercial CA. If the request is created on another machine, the private key must be moved from there to TR7 and protected along the way. Generating the key directly on TR7 and keeping it there eliminates this risk.

Solution: Two Methods

Your situation	Suitable method
Opening the request from the interface; the key should be generated on TR7 or selected from the library	Method 1: CSR (External CA) tab
Generating the request from the command line	Method 2: WEB-CLI

Method 1: CSR (External CA) Tab Recommended

• How it works The key and the CSR are generated on TR7; when the signed certificate is uploaded to the request, its match with the key is checked and a new Manual record is created in the certificate list. The request record is not deleted; the same CSR is re-signed in subsequent renewals.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → CSR (External CA) tab → Add
• Requirement A CA that will sign the certificate; if the key is to be selected from the library, a key in the Private Key Library
• Scope The resulting certificate is used on the encrypted frontends of HTTP and L7 TCP vServices

Step-by-Step Configuration

1

Adım 1 Open the CSR tab

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → SSL/TLS Certificates screen, the CSR (External CA) tab in the top strip is selected (CSR (External CA) tab).

2

Adım 2 Open the add form

Add is clicked (CSR add form).

3

Adım 3 Enter the subject information

Request Name is entered. Common Name (CN) is required (at most 128 characters; only letters, digits, spaces and . - _ ( ) ' are accepted). Organization (O), Organizational Unit (OU) and the two-letter Country (C) are optional. All the names the certificate will cover are written line by line in the Subject Alternative Names list; a wildcard name (*.example.com) can be written only in this list.

4

Adım 4 Select the key

If the default Generate a new key for this request is left in the Private Key field, Key Algorithm is selected (default RSA 2048; RSA 3072, RSA 4096, ECDSA P-256, ECDSA P-384). If the public key must stay the same in subsequent requests as well, Use a key from the library is selected and the key in the library is chosen (Can I manage Private Keys separately (Private Key Library)?).

5

Adım 5 Save the request

Add is clicked; the key and the CSR are generated, and the request is added to the list in the Waiting for Signature status. The CN, the SAN and the key selection cannot be changed later; in editing, only the name changes.

6

Adım 6 Download the CSR

The request row is right-clicked and Download the CSR is selected; the <request name>.csr file is passed to the CA. The CSR can also be taken with Copy from the Signing Request (PEM) row in the preview that opens when the row is clicked.

7

Adım 7 Open the signed certificate window

When the CA returns the certificate, the request row is right-clicked and Upload the signed certificate is selected (the same operation is also at the top right of the preview).

8

Adım 8 Paste the certificate

The certificate returned by the CA is pasted into the Signed Certificate (PEM) field or the file is dragged (at most 64 KB). The Name for the new certificate field comes filled in with the name of the request; it is changed if necessary.

9

Adım 9 Save

Accept is clicked. If the certificate does not match the key of the request, the upload is rejected and nothing is written; if it matches, a new record is created in the certificate list and the request becomes Signed. In a cluster setup, with the default auto-sync, the record is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

The chain of the resulting certificate is checked in the Chain tab, and the certificate is used by selecting it in the Certificate field of the vService (How do I add the intermediate certificate chain?). When the renewal time comes, the same CSR is re-signed by the CA and uploaded with Re-issue: upload a newly signed certificate in the request row; since the ID and the key of the certificate record do not change, no additional action is required on the vServices.

Verification

1Request and certificateTR7 side

In the CSR (External CA) tab, the status of the request and the Issued Certificate column are checked; the link is followed to the certificate record and the Chain tab is checked.

ExpectedStatus: Signed · Trust chain is complete

The Chain tab searches the chain up to the root CA; if the root certificate is not in the record, the name of the root CA appears in the "Missing intermediate certificate — required issuer" message. If the one named is an intermediate CA, the intermediate certificate is added.

Method 2: WEB-CLI

• How it workslb certificate create-csr generates the key and the CSR on the device and creates the request not in the CSR tab but as a record of the CSR (external CA) type in the certificate list. Downloading the CSR and pasting the signed certificate are done from the interface.
• Where it is opened TR7 WEB-CLI → lb certificate create-csr · SSL/TLS Certificates certificate list
• Requirement WEB-CLI access; a CA that will sign the certificate
• Scope The resulting certificate is used on the encrypted frontends of HTTP and L7 TCP vServices

Step-by-Step Configuration

1

Adım 1 Generate the request

name and cn are required; --san takes comma-separated names, and --keyAlgo is rsa2048 by default (create-csr):

lb certificate create-csr name portal-istek cn portal.example.com --o "Example Ltd" --c TR --san "portal.example.com,www.example.com" --keyAlgo rsa2048

2

Adım 2 Download the CSR

In the Certificates & PKI → SSL/TLS Certificates certificate list, the portal-istek row is right-clicked and Download CSR is selected; the file is passed to the CA.

3

Adım 3 Open the record edit form

When the CA returns the certificate, the same row is selected and Edit is clicked; the CSR content and the Certificate Content field appear in the form.

4

Adım 4 Paste the certificate

The certificate returned by the CA is pasted into the Certificate Content field; if necessary, the intermediate certificate is added to the Intermediate Cert. Content field.

5

Adım 5 Save

Edit at the bottom of the form is clicked; if the certificate does not match the key in the record, the record is rejected.

Verification

1RecordTR7 side

The record is listed in WEB-CLI; after the certificate is pasted, the CN and Valid Until columns are filled in in the certificate list.

Command: lb certificate list

Expectedportal-istek record in the list

Common Mistakes

• Writing a wildcard in the CN field. The Common Name (CN) field does not accept the * character; a wildcard name is written in the Subject Alternative Names list.
• Also uploading the signed certificate separately as the Manual type. Since the key is on TR7, the certificate is uploaded to the request itself with Upload the signed certificate; for a separate Manual record, the key is not at hand.
• Trying to assign the CSR record to a vService. Requests are not listed in the certificate selectors of the vService and backend forms; the certificate record created when the signed certificate is uploaded is assigned to the vService.
• Opening a new request on renewal. A new request generates a new key and creates a new certificate record; the certificate must be selected again on the vServices. The Re-issue operation of the same request preserves the record and the key.
• Deleting the request and thinking the certificate has also been deleted. When the request is deleted, the certificate record generated from it stays in the list; however, Re-issue can no longer be done with that request.

How it is done in the documentation

• SSL/TLS Certificates · CSR (External CA) Tab
• SSL/TLS Certificates · The CSR (External CA) Adding Form
• SSL/TLS Certificates · The External CA Flow
• WEB-CLI · lb certificate create-csr

Related questions

• Can I manage Private Keys separately (Private Key Library)?
• Can I use a wildcard certificate?
• When I renew a certificate, do I need to replace it on each vService one by one?