Skip to content
Docs sslbrain sslbrain.com

Barracuda Web Application Firewall

Copy link to the page “Barracuda Web Application Firewall”

← All integrations

Web server · Firewall and VPN · Load balancer

Installs and renews the certificate on an HTTPS service or one SNI domain in Barracuda WAF, with a TLS check and automatic rollback.

The appliance runs the package and connects to Barracuda Web Application Firewall through Barracuda WAF REST API v3.2 over HTTPS on port 8443. No agent is installed on Barracuda Web Application Firewall.

What happens

  1. The appliance connects to Barracuda Web Application Firewall through Barracuda WAF REST API v3.2 on port 8443.
  2. Before anything changes, the package fetches the certificate the target presents over TLS with the right server name (SNI) and checks by serial number that it is the certificate the WAF has bound to the target. If that cannot be decided unambiguously, or the service does not answer, nothing is changed and the result carries a log that can be shared.
  3. Certificate, key and chain are uploaded as a new certificate object named sslbrain- and 12 characters of the fingerprint, with private key export off. The package puts it only in the target's slot of the service's SSL Security (RSA or ECDSA, by the certificate's key) and reads the settings back. Other services, SNI domains and settings are not changed. If it fails: If the read-back shows anything other than that one change, the intended settings are sent once more. If they still do not read back, the previous settings are written back, read back, and the previous certificate is checked.
  4. Verification: the package makes TLS handshakes to the service's address and port with the same server name until the service presents the new certificate. If it fails: If the service does not present the new certificate within the wait, the package puts the previous binding back in the same run, reads it back and checks that the previous certificate is presented again. When the service has both an RSA and an ECDSA certificate and the check can negotiate only the other, unchanged one, that is reported as a warning without rollback.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to Barracuda WAF REST API v3.2, port 8443. No agent is installed.
Service ports
8443
You need
User name and password of a WAF administrator who may read services and certificates and write certificates and the service's SSL Security. The password is sent only in the login request and the session token only in the Authorization header, never in a URL or on a command line. Discovery shows every HTTPS service and SNI domain, and the rule picks one of them.
Platform
Barracuda Web Application Firewall (hardware and virtual) with firmware 11.0 or later and REST API v3.2
Actions
Discovery, Installation, Verification, Rollback
Packages
barracuda-waf-api 1.0.0
Note
  • The WAF renews its own Let's Encrypt certificates automatically. When you choose a target that uses such a certificate, the package moves only that target to its own certificate. The Let's Encrypt certificate, its automatic renewal and other services that use it are not changed or deleted. Discovery shows which targets use the WAF's Let's Encrypt.
  • The package never deletes anything. When it gets no answer to a change, it reads the WAF before doing anything more and never sends the same change twice. If someone else changed the service's SSL Security during the upload, the package does not switch.
  • Rollback puts the previous certificate back in the target's slot only while the slot still holds the certificate the deploy put there. Otherwise nothing changes.
  • Barracuda publishes REST API v3.2 for firmware 11.0. When a WAF does not answer on v3.2, the package reports that and changes nothing. Firmware 11.0 fixed faults that changed SNI and protocol settings when SNI certificates were set through the API.
  • The connection to the WAF's REST API is verified by default against the system trust store, a CA bundle or a fingerprint in MANAGEMENT_TLS_PIN_SHA256. When the appliance reaches the service through NAT, the address, port and server name for the check go in BARRACUDA_SERVICE_HOST, BARRACUDA_SERVICE_PORT and BARRACUDA_SERVICE_SNI.
  • In an HA pair the package changes the unit it connects to. Barracuda documents configuration synchronisation between the partners; the package does not read the partner.
  • Barracuda CloudGen Firewall and WAF-as-a-Service are different products with their own APIs.

Certificate requirements

Key: RSA or ECDSA. Barracuda documents no key size limit for uploads and no maximum; the WAF itself creates RSA 1024, 2048 and 4096 bits and ECDSA P-256, P-384 and P-521. The package takes RSA 2048, 3072 and 4096 bits and ECDSA P-256 and P-384. An RSA certificate goes in the service's RSA slot and an ECDSA certificate in the ECDSA slot.

Common Name, clientAuth EKU and keyEncipherment KU: Barracuda does not document that any of them is required. The upload takes no CN and the package requires none of them, so certificates from profiles without a CN, such as Let's Encrypt tlsserver and Google minimal, are delivered like any other.

Names: wildcard and SAN certificates are documented for HTTPS services and SNI. IP addresses as names and a maximum number of SAN names for uploads are not documented; the limit of 99 SAN names applies to the WAF's own Let's Encrypt ordering.

Format and chain: the WAF takes a PEM certificate with a separate key, or PKCS#12; DER and JKS are not documented. The package uploads PEM with an unencrypted key, so PKCS#12 encryption (3DES/RC2 or AES), which Barracuda does not document, does not matter here. The chain is uploaded with the server certificate first and then each issuer in order, as Barracuda's guide describes; the package orders the chain itself and sends a supplied root along.

Name of the certificate object: REST API v3.2 publishes no length or character rule; the package uses sslbrain- and 12 hex characters (21 characters). Lifetime: Barracuda documents no minimum or maximum lifetime. From firmware 12.2, certificates signed with MD5 or SHA-1 are not supported.

Get started