Automatic Certificate Management in Barracuda WAF-as-a-Service

Barracuda WAF-as-a-Service integrates with certificate authorities to automate the issuance and renewal of SSL/TLS certificates. When Automatic Certificate Management is enabled for a domain, the Barracuda WAF-as-a-Service securely authenticates with the configured certificate authority, provisions or renews the certificate, and associates it with the specified domain.

By default, Barracuda WAF-as-a-Service uses Let’s Encrypt through Barracuda’s certificate authority credentials to issue and renew certificates automatically. If you prefer to use a different certificate authority, you can add the CA details on the Certificate authority credentials page and select the CA on the Endpoints page. Once configured, the system manages all interactions with the certificate authority, including certificate issuance, renewal, and deployment to the associated domains, without requiring manual intervention.

Supported Certificate Authorities

Barracuda WAF-as-a-Service currently supports the following Certificate Authorities (CAs):

• Let’s Encrypt (default)

• DigiCert

• GlobalSign

• SECOM

• Sectigo

• ZeroSSL

• Google Trust Services

Adding Certificate Authority Details

1. In the WAF-as-a-Service web interface, click Resources > Certificate Management > Certificate authority credentials.
   
   

   Open

   

2. On the Certificate authority credentials page, click Add new credential.

   Open

   

3. In the Add credentials section:

   1. Configure the following for Sectigo, ZeroSSL and Google Trust Services:

      1. Name: Enter a name to identify the CA account on the Barracuda WAF-as-a-Service.

      2. Certificate authority: Select the CA from the drop-down list.

      3. EAB KID: Enter the unique Key Identifier (KID) that associates your account with the Hash-based Message Authentication Code (HMAC) authentication process.

      4. HMAC Key: Enter the shared secret key (credential) used to authenticate your account with the specified CA server.

   2. Click Save.

   3. Configure the following for DigiCert, GlobalSign and SECOM:

      1. Name: Enter a name to identify the CA account on the Barracuda WAF-as-a-Service.

      2. Certificate authority: Select the CA from the drop-down list.

      3. CA URL: Enter the CA ACME server URL that the Barracuda WAF-as-a-Service should use to communicate and process certificate requests.

      4. Directory URL (Optional): Enter the CA ACME Directory URL that the Barracuda WAF-as-a-Service will use to automate certificate issuance with the specified CA.

      5. EAB KID: Enter the unique Key Identifier (KID) that associates your account with the Hash-based Message Authentication Code (HMAC) authentication process .

      6. HMAC Key: Enter the shared secret key (credential) used to authenticate your account with the specified CA server.

   4. Click Save.

After configuring certificate authority details, navigate to the Endpoints page to associate the CA with the domain.

Associating the Certificate Authority with a Domain

1. In the WAF-as-a-Service web interface, click Applications in the left panel.

2. On the Applications page, click on the application to which you want to associate with the CA.

3. In the left panel, click Endpoints.

4. On the Endpoints page:

   1. Modify an existing endpoint configured for HTTPS or click Add Endpoint to add a new endpoint with Service Type set to HTTPS.

5. On the Edit Endpoint or New Endpoint window:

   1. Scroll down and enable Automatic Certificate Management.

   2. Select the certificate authority from the Certificate drop‑down list.

   3. Click Save to apply the configuration.

Certificate Renewal Behavior

For endpoints using the default Let’s Encrypt certificate:

• If Certificate Authority (CA) details are added on the Certificate Authority Credentials page and the new CA is associated to the endpoint on the Endpoints page, the Barracuda WAF-as-a-Service will continue to use the existing Let’s Encrypt certificate until it expires.

• After the Let’s Encrypt certificate expires, a new certificate from the selected CA will be automatically generated and applied to the endpoint.

To replace an active certificate with a new CA certificate before expiration:

1. Add CA details on the Certificate Authority Credentials page.

2. Associate the new CA with the endpoint on the Endpoints page.

3. Contact Barracuda Technical Support for guidance and assistance.