config

## F5 BIG-IP ACME Client Provider Configuration File
## Maintainer: kevin-at-f5-dot-com
## Version: 20260512-1
## Description: Contains per-provider ACME client configuration settings



########################################################
## PROVIDER COMMON SETTINGS ############################
########################################################

# Extra options passed to the curl binary (default: <unset>)
# Common options:
#   --http1.1          = use HTTP/1.1
#   -k                 = ignore certificate errors
#   -x <proxy-url>     = use an explicit proxy
# Ex. CURL_OPTS="--http1.1 -k -x 10.1.10.150:3128"
CURL_OPTS="--http1.1 -k"

# Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1 (overridden by -a commandline option)
KEY_ALGO=rsa

# Default keysize for private keys (default: 4096)
KEYSIZE="2048"

# E-mail to use during the registration (default: <unset>)
CONTACT_EMAIL=admin@f5labs.com

# Option to add CSR-flag indicating OCSP stapling to be mandatory (default: no)
# Default set to 'no' to accomdate LetsEncrypt: https://letsencrypt.org/2024/12/05/ending-ocsp
OCSP_MUST_STAPLE="no"

## Threshold in days when a certificate must be renewed (default: 30 days)
THRESHOLD=30

## Amount of seconds to wait for processing of order until erroring out (default: 0 => no timeout)
ORDER_TIMEOUT=0

## Amount of seconds to wait for domain validation processing until erroring out (default: 0 => no timeout)
VALIDATION_TIMEOUT=0

## Option to select the ACMEv2 methods: http-01 (default) or dns-01
ACME_METHOD="http-01"
## ACME_METHOD="dns-01"
## ACME_METHOD="tls-alpn-01"

## DNS-01 option to perform ACMEv2 dns-01 in 2-phases manually (no API) -- requires an interactive shell to use this feature
## Phase1: Manually deploy the TXT records to the DNS service
## Phase2: Manually delete the TXT record
DNS_2_PHASE=false

## DNS-01 option to add delay (in second) between deploy and clean challenge functions
DNS_DELAY=10

## Option to force HA sync on certificate updates. When disabled, change data is stored to iFile object and requires an auto sync to ensure
## consistency. When this option is enabled, an HA sync is triggered when there is an update to any of the certificates. (default: false)
FORCE_SYNC=false

## When FORCE_SYNC is true, you must also specify the BIG-IP Device Group name.
DEVICE_GROUP=mydevicegroup

## Set to true to always generate a private key. Otherwise a CSR is created from an existing key to support HSM/FIPS environments (default: false)
ALWAYS_GENERATE_KEY=true

## Set to true to attempt OCSP revocation check on existing certificates (default: false)
CHECK_REVOCATION=false

## Set to true to generate error logging (default: true)
ERRORLOG=true

## Set to true to generate debug logging (default: false)
DEBUGLOG=false

## Set to a Syslog facility and severity level if Syslog is required for log events (ex. local0.err). Leave empty to disable Syslog.
SYSLOG=""

## Set to the name of a local Bash script to be used to copy a certificate and key to a control plane location. Used to support ACME
## renewal for device certificates. Example: DEVICEHOOK="/shared/acme/f5devicehook.sh"
DEVICEHOOK=""


########################################################
## DNS-01 PROVIDER SETTINGS ############################
########################################################
## Options required for DNS API -- uses dnsapi scripts
## - Add the necessary script to the local folder (ex. /shared/acme/dnsapi)
## - Update the DNSAPI variable below with the name of the script (without .sh)
## - Include any other required variables
## Included scripts are gratuitously borrowed from acme.sh and modified for local use: https://github.com/acmesh-official/acme.sh/wiki/dnsapi
## ========================================================
## dns_nsupdate (bind/rfc2136)
## DNSAPI=dns_nsupdate
## NSUPDATE_SERVER="192.168.100.53"
## NSUPDATE_SERVER_PORT=53
## NSUPDATE_KEY="/shared/acme/dnsapi/dns_nsupdate_creds.ini"


########################################################
## ADVANCED PROVIDER SETTINGS ##########################
########################################################

# Minimum days before expiration to automatically renew certificate (default: 30)
#RENEW_DAYS="30"

# Fetch OCSP responses (default: no)
#OCSP_FETCH="yes"

# OCSP refresh interval (default: 5 days)
#OCSP_DAYS=5

# Extended Account Binding (EAB) support
#EAB_KID=kid-1
#EAB_HMAC_KEY=zWNDZM6eQGHWpSRTPal5eIUYFTu7EajVIog

## Set to true to install the complete certificate chain, or false to only install the leaf certificate (default: true)
#FULLCHAIN=true

## Set the preferred number of zeroization cycles for shredding created private keys (default: 3 cycles)
#ZEROCYCLE=3

## Set to true to generate new client SSL profiles with new certs/keys (default: false)
#CREATEPROFILE=false



########################################################
## STATIC SETTINGS - DO NOT TOUCH ######################
########################################################

# Output directory for challenge-tokens to be served by webserver or deployed in HOOK (default: /var/www/dehydrated)
WELLKNOWN="/tmp/wellknown"

# Program or function called in certain situations
# BASEDIR and WELLKNOWN variables are exported and can be used in an external program
HOOK=${BASEDIR}/f5hook.sh