Identify Unused SSL Certificate Objects from F5 Devices

Why Orphaned SSL Certificates Are a Hidden Risk in F5 Environments

SSL/TLS certificates are critical for securing applications hosted behind F5 BIG-IP load balancers. Over time, however, certificate inventories tend to grow as applications are migrated, decommissioned, renamed, or replaced. While the associated virtual servers and SSL profiles may be removed, the certificate objects often remain on the F5 device.

These unused or orphaned certificate objects may seem harmless, but they can introduce operational, security, and compliance risks that are often overlooked.

Regularly identifying and removing unused SSL certificate objects helps maintain a secure, compliant, and manageable F5 environment.

Identify Unused SSL Certificate Objects from F5 Devices

What Is an Unused SSL Certificate Object?

An SSL certificate object is considered unused when it exists on the F5 device but is not referenced by any active configuration component, such as:

Client SSL Profiles

Server SSL Profiles

Virtual Servers

SSL Forward Proxy configurations

iRules/Policies

Application Services

In other words, the certificate remains stored on the device even though no active traffic or application depends on it.

Risk of Orphaned SSL Certificates Risk

Orphaned SSL certificates — those still active but no longer tracked, monitored, or associated with any owner or renewal process — carry a distinct and often underappreciated risk profile compared to simply expired certificates.

Automating the Process

Manual audits are time-consuming and prone to error, especially in large environments. By leveraging F5 TMOS commands, Ansible Automation Platform, and reporting workflows, organizations can automatically:

Discover SSL certificate objects.

Detect orphaned certificates.

Identify certificates nearing expiration.

Generate HTML and CSV reports.

Store audit history in Git repositories.

Notify stakeholders via email.

Automation transforms certificate management from a reactive task into a proactive security control.

Method 1: Use F5 iHealth (Easiest & Safest)

1. Generate a qkview archive file from your BIG-IP system.

qkview device_name_date.qkview

1. Upload the qkview file to the F5 iHealth Portal.

https://ihealth.f5.com/

1. Click on the Diagnostics tab on the left-side menu.
2. Look for the heuristic entry titled: “F5 recommends removing orphaned configuration objects”.
3. Click Config Explorer > Unassigned Objects to view the list of completely unused SSL profiles and certificates.

iHealth screen

Method 2: Cross-Reference via TMSH (Command Line)

If you prefer using the CLI, you can manually isolate which certificates are installed but not bound to any active Client-SSL or Server-SSL profiles. Log into your BIG-IP command line via SSH.

*** Note:- Few SSL certs are used for iRule & device ca bundle.

Method 3: The GUI Bulk-Delete Method

The BIG-IP web interface has built-in dependency tracking that prevents you from deleting objects currently in use. You can leverage this logic to find and remove unused items safely. Navigate to System > File Management > SSL Certificate List.

1. Select the checkbox at the top to highlight all certificates in the list.
2. Click the Delete button.
3. The system will throw an error or filter out certificates tied to profiles. It will only allow you to delete certificates that are entirely unused.

Note: For this method to completely clean your system, you must first navigate to Local Traffic > Profiles > SSL, mass-delete unassigned SSL profiles first, and then perform the mass delete on the certificate list.

Method 4: Follow the next article for end to end automations.

Conclusion

Unused SSL certificate objects may not impact application availability directly, but they create significant security, compliance, and operational challenges. Expired certificates, exposed private keys, cluttered inventories, and unnecessary renewal activities all contribute to increased risk. Regular audits and automated discovery of orphaned certificates on F5 devices help organizations maintain a clean certificate inventory, strengthen security posture, and simplify compliance efforts.

A well-governed certificate inventory is not just an operational best practice — it’s an essential component of modern infrastructure security.