bigip_profile_client_ssl - Manages client SSL profiles on a BIG-IP¶

New in version 2.5.

Synopsis
- Requirements
Parameters
Notes
Examples
Return Values
Status
- Author

Synopsis ¶

Manages client SSL profiles on a BIG-IP.

Requirements ¶

The below requirements are needed on the host that executes this module.

f5-sdk >= 3.0.9

Parameters ¶

Parameter	Choices/Defaults	Comments
cert_key_chain		One or more certificates and keys to associate with the SSL profile. This option is always a list. The keys in the list dictate the details of the client/key/chain combination. Note that BIG-IPs can only have one of each type of each certificate/key type. This means that you can only have one RSA, one DSA, and one ECDSA per profile. If you attempt to assign two RSA, DSA, or ECDSA certificate/key combo, the device will reject this. This list is a complex list that specifies a number of keys. There are several supported keys.
key required		Contains a key name.
cert required		Specifies a cert name for use.
chain		Contains a certificate chain that is relevant to the certificate and key mentioned earlier. This key is optional.
passphrase		Contains the passphrase of the key file, should it require one. Passphrases are encrypted on the remote BIG-IP device. Therefore, there is no way to compare them when updating a client SSL profile. Due to this, if you specify a passphrase, this module will always register a `changed` event.
ciphers		Specifies the list of ciphers that the system supports. When creating a new profile, the default cipher list is `DEFAULT`.
name required		Specifies the name of the profile.
parent	Default: /Common/clientssl	The parent template of this monitor template. Once this value has been set, it cannot be changed. By default, this value is the `clientssl` parent on the `Common` partition.
partition (added in 2.5)	Default: Common	Device partition to manage resources on.
password required		The password for the user account used to connect to the BIG-IP. You can omit this option if the environment variable `F5_PASSWORD` is set. aliases: pass, pwd
provider (added in 2.5)		A dict object containing connection details.
ssh_keyfile		Specifies the SSH keyfile to use to authenticate the connection to the remote device. This argument is only used for cli transports. If the value is not specified in the task, the value of environment variable `ANSIBLE_NET_SSH_KEYFILE` will be used instead.
timeout	Default: 10	Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands. If the timeout is exceeded before the operation is completed, the module will error.
server required		The BIG-IP host. You can omit this option if the environment variable `F5_SERVER` is set.
user required		The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You can omit this option if the environment variable `F5_USER` is set.
server_port	Default: 443	The BIG-IP server port. You can omit this option if the environment variable `F5_SERVER_PORT` is set.
password required		The password for the user account used to connect to the BIG-IP. You can omit this option if the environment variable `F5_PASSWORD` is set. aliases: pass, pwd
validate_certs	Choices: no yes ←	If `no`, SSL certificates will not be validated. Use this only on personally controlled sites using self-signed certificates. You can omit this option if the environment variable `F5_VALIDATE_CERTS` is set.
transport required	Choices: rest cli ←	Configures the transport connection to use when connecting to the remote device.
server required		The BIG-IP host. You can omit this option if the environment variable `F5_SERVER` is set.
server_port (added in 2.2)	Default: 443	The BIG-IP server port. You can omit this option if the environment variable `F5_SERVER_PORT` is set.
state (added in 2.5)	Choices: present ← absent	When `present`, ensures that the profile exists. When `absent`, ensures the profile is removed.
user required		The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You can omit this option if the environment variable `F5_USER` is set.
validate_certs (added in 2.0)	Choices: no yes ←	If `no`, SSL certificates will not be validated. Use this only on personally controlled sites using self-signed certificates. You can omit this option if the environment variable `F5_VALIDATE_CERTS` is set.

Notes ¶

Note

Requires BIG-IP software version >= 12
For more information on using Ansible to manage F5 Networks devices see https://www.ansible.com/integrations/networks/f5.
Requires the f5-sdk Python package on the host. This is as easy as pip install f5-sdk.

Examples ¶

- name: Create client SSL profile
  bigip_profile_client_ssl:
    state: present
    server: lb.mydomain.com
    user: admin
    password: secret
    name: my_profile
  delegate_to: localhost

- name: Create client SSL profile with specific ciphers
  bigip_profile_client_ssl:
    state: present
    server: lb.mydomain.com
    user: admin
    password: secret
    name: my_profile
    ciphers: "!SSLv3:!SSLv2:ECDHE+AES-GCM+SHA256:ECDHE-RSA-AES128-CBC-SHA"
  delegate_to: localhost

- name: Create a client SSL profile with a cert/key/chain setting
  bigip_profile_client_ssl:
    state: present
    server: lb.mydomain.com
    user: admin
    password: secret
    name: my_profile
    cert_key_chain:
      - cert: bigip_ssl_cert1
        key: bigip_ssl_key1
        chain: bigip_ssl_cert1
  delegate_to: localhost

Return Values ¶

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
ciphers string	changed	The ciphers applied to the profile. Sample: !SSLv3:!SSLv2:ECDHE+AES-GCM+SHA256:ECDHE-RSA-AES128-CBC-SHA

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Author ¶

Tim Rupp (@caphrim007)

Hint

If you notice any issues in this documentation you can edit this document to improve it.