Knowledge Base

How to Generate a Certificate Signing Request (CSR) for F5 BIG-IP Version 13.x and Later

Updated on August 14, 2026

Overview

By the end of this article, you will have generated a Certificate Signing Request (CSR) in the F5 BIG-IP Configuration utility and saved it to your computer, ready to submit to Sectigo for certificate issuance. The article covers three stages: signing in to the BIG-IP Configuration utility and opening the SSL Certificate List, completing the certificate details, including the Common Name, organization fields, and the key type and key size, and then downloading or copying the finished request.

A Certificate Signing Request (CSR) is the encoded file that contains your certificate details and public key; the certificate itself is issued separately once the request has been submitted and validated.

Prerequisites

Before you begin, confirm that you have the following:

F5 BIG-IP version 13.x or later.
An administrative account for the BIG-IP Configuration utility.
The certificate details you intend to submit: the Common Name, division, organization, locality, state or province, and country.

Steps to Generate a Certificate Signing Request (CSR) in F5 BIG-IP

Step 1: Open the SSL Certificate List

The SSL Certificate List is the page in the BIG-IP Configuration utility where certificates and pending requests are managed.

Sign in to the BIG-IP Configuration utility with an administrative account.
From the Main tab, navigate to System → Certificate Management → Traffic Certificate Management → SSL Certificate List. The SSL Certificate List screen opens.
Click Create.

Figure 1: BIG-IP Configuration utility sign-in page

Figure 2: BIG-IP Main tab navigation path to Traffic Certificate Management and the SSL Certificate List

Figure 3: SSL Certificate List screen with the Create button

Step 2: Enter the Certificate Details

On the create screen, complete the fields below, then click Finished. The Certificate Signing Request screen is displayed.

Field	What to Enter
Name	A unique name that identifies this certificate inside BIG-IP.
Issuer	Select Certificate Authority.
Common Name	The name clients will use to reach the site, typically the website address, for example www.siterequest.com.
Division	Your department name.
Organization	Your company's legally registered name.
Locality	Your city name.
State or Province	Your state or province name, written in full.
Country	Select your country from the list.
Key Type	The public key algorithm, for example Rivest–Shamir–Adleman (RSA).
Key Size	The key length, for example 2048 bits.

Figure 4: BIG-IP create certificate screen with the Common Name, organization, and Key Type fields

Step 3: Download or Copy the Certificate Signing Request (CSR)

The Certificate Signing Request screen displays the finished request. Save it using either method below, then click Finished.

Copy the text: Select the entire contents of the Request Text field, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, and paste it into your Sectigo order.
Download the file: Next to Request File, click the download button to save the request as a file on your computer.

Figure 5: Certificate Signing Request screen with the Request Text field and the Request File download option

Before publishing: Check all five screenshots for the appliance hostname, management IP address, the logged-in administrator account name, existing certificate names in the SSL Certificate List, and any real Common Name values, and mask anything that identifies a real device or environment.

How to Verify Success

Confirm the request was created correctly before submitting it:

Return to the SSL Certificate List and confirm the new entry appears with the name you entered in Step 2.
Open the saved request file or the copied text and confirm it begins with -----BEGIN CERTIFICATE REQUEST----- and ends with -----END CERTIFICATE REQUEST-----, with no extra spaces or blank lines.
Check that the Common Name shown on the certificate details matches the address clients will use. A mismatch cannot be corrected after issuance without a reissue.

Troubleshooting

Issue: Sectigo rejects the submitted Certificate Signing Request (CSR) as invalid.
Cause: The request text was copied incompletely, or the BEGIN and END lines were omitted.
Solution: Return to the Certificate Signing Request screen in BIG-IP, copy the full contents of the Request Text field including both boundary lines, and resubmit.

Issue: The Create button is not available on the SSL Certificate List screen.
Cause: The signed-in account does not have administrative permissions for certificate management.
Solution: Sign in with an account that has an administrative role in the BIG-IP Configuration utility.

Issue: The issued certificate shows the wrong name when installed.
Cause: The Common Name entered in Step 2 does not match the address clients use to reach the site.
Solution: Generate a new Certificate Signing Request (CSR) with the correct Common Name and request a reissue from Sectigo.