Knowledge Base

How to Install SSL/TLS Server Certificates on F5 BIG-IP Version 13.x and Later

Updated on August 14, 2026

Overview

By the end of this article, your F5 BIG-IP device will present your Sectigo-issued SSL/TLS certificate together with its full trust chain on a client SSL profile, so that traffic to the virtual server is secured.

The installation has two parts. Part 1 imports the chain bundle, the file containing Sectigo's intermediate certificates, into the SSL Certificate List in the BIG-IP web interface. Part 2 imports the server certificate against the key created with your Certificate Signing Request (CSR), then binds the certificate, key, and chain together in a client SSL profile. The article closes with verification and the most common installation failures.

Prerequisites

Before you begin, confirm that you have the following:

F5 BIG-IP version 13.x or later, and an administrative account for the BIG-IP web interface.
The private key already present on the device from the Certificate Signing Request (CSR) you generated. Note the name you assigned to it. You will select it by that name in Part 2.
The certificate files downloaded from Sectigo:

File	What it contains
Server certificate	Your signed SSL/TLS certificate.
Chain bundle	Sectigo's intermediate certificates, bundled in a single file.

Part 1 — Import the Sectigo chain bundle

The chain bundle contains the intermediate certificates that link your server certificate to Sectigo's trusted root. It must be imported before the server certificate so the full chain can be assembled.

Sign in to the F5 BIG-IP web interface with an administrative account.

Figure 1: BIG-IP web interface sign-in page
On the Main tab, expand System.

Figure 2: Main tabBIG-IP Main tab with the System menu expanded
Click Certificate Management → Traffic Certificate Management → SSL Certificate List. The list of existing certificates is displayed.

Figure 3 and 4: Certificate Management → Traffic Certificate Management → SSL Certificate List.
In the upper-right corner, click Import.

Figure 5: SSL Certificate List showing existing certificates and the Import button
From the Import Type list, select Certificate.

Figure 6: Import Type list, select Certificate.
In the Certificate Name field, enter SectigoChain. In the Certificate Source box, browse to the chain bundle file you downloaded.

Figure 7: Certificate Import screen with the Certificate Name and Certificate Source fields
Click Import. The new certificate appears in the list as SectigoChain.

Figure 8: SSL Certificate List with the imported SectigoChain entry

Part 2 — Import the server certificate and bind it to a client SSL profile

In this part you attach the issued server certificate to the existing private key, then create or edit a client SSL profile that presents the certificate, key, and chain together.

Import the server certificate

Go to System → Certificate Management → Traffic Certificate Management → SSL Certificate List.

Figure 9: Imported SectigoChain certificate visible in the F5 BIG-IP SSL Certificate List
Click the name you assigned to the key file when you created your Certificate Signing Request (CSR). In the source article's example, that name is F5SSLCertificate.

Figure 10: CSR key entry selected in the SSL Certificate List for server certificate import.
Click Import.

Figure 11: Import the issued server certificate into the existing CSR key entry.
In the Certificate Source box, browse to the server certificate file you downloaded from Sectigo, then click Import.

Figure 12: Import the server certificate file into the existing CSR key entry.
Confirm that the server certificate and key now appear together in the SSL Certificate List.

Figure 13: CSR key entry selected for SSL/TLS server certificate installation

Bind the certificate to a client SSL profile

On the Main tab, expand Local Traffic and click Profiles.

Figure 14: Profiles page used to configure Client SSL profiles in F5 BIG-IP
In the top menu bar, click SSL → Client.

Figure 15: Client SSL profile list in F5 BIG-IP.
Click Create to add a new client SSL profile or open an existing profile you have already set up.

Figure 16: Create a new Client SSL profile for SSL/TLS certificate configuration.
From the Configuration list, select Advanced, and select the Custom check box.

Figure 17: Advanced and Custom settings enabled for Client SSL profile configuration.
Scroll to the Certificate Key Chain section of the profile.
Click Add.

Figure 18: Click Add to configure the certificate, key, and chain for the Client SSL profile
Under Certificate, select your server certificate. It appears under the same friendly name as the private key.
Under Key, select the key from the list. This is the key generated with your Certificate Signing Request (CSR), before the certificate was requested.
Under Chain, select SectigoChain, imported in Part 1, then click Add.

Figure 19: Select the certificate, key, and chain, then click Add to create the Certificate Key Chain entry.
Confirm the entry now appears in the Certificate Key Chain box.

Figure 20: Certificate, key, and chain successfully configured in the Client SSL profile.
Scroll down and click Finished to save the profile.

Your SSL/TLS certificate should now be installed.

Image descriptions for Part 2

Important: Before publishing, check every screenshot for the appliance hostname, management IP address, the signed-in administrator account name, partition names, certificate serial numbers, and any real certificate or key names in the SSL Certificate List, and mask anything that identifies a real device or environment.

How to Verify Success

Confirm the certificate is installed and being served:

In the SSL Certificate List, confirm both the server certificate and SectigoChain are present.
Open the client SSL profile and confirm the Certificate Key Chain entry lists the certificate, the key, and SectigoChain together.
Confirm the client SSL profile is assigned to the virtual server that handles the traffic. A certificate installed but not attached to a virtual server is not served.
Browse to the site over HTTPS and confirm no certificate warning appears, then use Sectigo's SSL install checker to confirm the full chain is presented.

Troubleshooting

Issue: Browsers report an untrusted or incomplete chain even though the certificate is installed.
Cause: The chain was not selected in the Certificate Key Chain entry, or the chain bundle was never imported.
Solution: Repeat Part 1 to import the chain bundle, then edit the client SSL profile and select SectigoChain in the Chain list.

Issue: The server certificate does not appear alongside a key in the SSL Certificate List.
Cause: The certificate was imported as a new entry instead of against the existing key created with the Certificate Signing Request (CSR).
Solution: Repeat Part 2, selecting the existing key name first and importing the certificate into that entry.

Issue: The site still presents the previous or default certificate after the profile is saved.
Cause: The updated client SSL profile is not assigned to the virtual server.
Solution: Open the virtual server configuration and set the SSL Profile (Client) to the profile you edited.

Issue: The Certificate Key Chain section is not visible in the profile.
Cause: The profile is still set to Basic configuration.
Solution: Set Configuration to Advanced and select the Custom check box, as described in step 9.