KEMP LoadMaster: SSL certificate via ACME proxy

Q: What kind of API user do I need on KEMP?

A dedicated API user with All Permissions for SSL Certificates and Real Servers / Virtual Services. Set the login method to Local User and use a strong password. If you use 2FA in the web UI, exempt the API user, since 2FA is not supported on API calls.

KEMP LoadMaster has a built-in "Let\'s Encrypt" integration whose endpoint cannot be redirected to the FairSSL ACME server. We use a proxy host to issue the certificate via FairSSL AutoDNS and push it to KEMP via the API. Neither KEMP\'s management interface nor your DNS provider needs special access.

How the setup is wired

✓ A small Linux host (typically an existing management server) runs Lego.
✓ Lego issues the certificate via FairSSL AutoDNS. No DNS API access required.
✓ A deploy hook converts the certificate to KEMP\'s expected format and calls the LoadMaster API.
✓ KEMP imports the new certificate and updates the Virtual Services that should use it.
✓ cron or systemd runs Lego daily. ARI drives renewal.

Setup

Step 1: Create an API user on KEMP

In the LoadMaster UI: go to System Configuration → User Management and create a local user (e.g. acme-deploy) with All Permissions for SSL Certificates and Virtual Services. Use a strong password and record it - we store it in a credentials file on the proxy host. Exempt the user from 2FA if you use it, since API calls do not support 2FA.

Step 2: Install Lego on the proxy host

Use Lego v5.0.4 or newer. The following command fetches the latest release and installs the binary to /usr/local/bin/lego.

arch=$(dpkg --print-architecture)
case "$arch" in amd64|arm64) ;; *) echo "Adjust arch"; exit 1 ;; esac
version=$(curl -fsSL https://api.github.com/repos/go-acme/lego/releases/latest \
  | sed -n 's/.*"tag_name": "\(v[^"]*\)".*/\1/p' | head -1)
curl -fL "https://github.com/go-acme/lego/releases/download/${version}/lego_${version}_linux_${arch}.tar.gz" \
  | sudo tar -xz -C /usr/local/bin lego
sudo install -d -m 0700 /etc/ssl/kemp

Step 3: Create the deploy script

The script builds a PEM bundle (certificate + chain + private key), uploads it to KEMP via /access/addcert and binds it to the chosen Virtual Service via /access/modvs.

sudo tee /usr/local/bin/kemp-deploy.sh > /dev/null << 'SCRIPT'
#!/bin/bash
set -euo pipefail
KEMP_HOST="lb.example.com"
KEMP_USER="acme-deploy"
KEMP_PASS="YOUR_API_PASSWORD"
CERT_NAME="fairssl-acme-cert"
VS_INDEX="1"   # Virtual Service ID (look up in KEMP UI under "Virtual Services")

CERT="$LEGO_HOOK_CERT_PATH"
KEY="$LEGO_HOOK_CERT_KEY_PATH"
BUNDLE=$(mktemp)
cat "$CERT" "$KEY" > "$BUNDLE"

# Upload (replace=1 overwrites an existing cert with the same name)
curl -sS -k --user "$KEMP_USER:$KEMP_PASS" \
  --data-binary "@$BUNDLE" \
  "https://$KEMP_HOST/access/addcert?cert=$CERT_NAME&replace=1"

# Bind the certificate to the Virtual Service
curl -sS -k --user "$KEMP_USER:$KEMP_PASS" \
  "https://$KEMP_HOST/access/modvs?vs=$VS_INDEX&certfile=$CERT_NAME"

rm -f "$BUNDLE"
SCRIPT
sudo chmod +x /usr/local/bin/kemp-deploy.sh

Step 4: Issue the certificate

Make sure the domain is configured for FairSSL AutoDNS. Run Lego once with the EAB keys.

sudo /usr/local/bin/lego run \
  --domains "lb.example.com" \
  --server https://fairssl.dk/acme \
  --eab --eab.kid YOUR_EAB_KID --eab.hmac YOUR_EAB_HMAC \
  --accept-tos --email acme-client@fairssl.dk \
  --http --http.webroot "/var/www/html" \
  --path "/etc/ssl/kemp" \
  --deploy-hook "/usr/local/bin/kemp-deploy.sh"

Step 5: Schedule daily with cron

# /etc/cron.d/lego-kemp
17 04 * * * root /usr/local/bin/lego run \
  --domains "lb.example.com" \
  --server https://fairssl.dk/acme \
  --accept-tos --email acme-client@fairssl.dk \
  --http --http.webroot "/var/www/html" \
  --path "/etc/ssl/kemp" \
  --renew-days 7 \
  --deploy-hook "/usr/local/bin/kemp-deploy.sh"

Step 6: Verify

In the LoadMaster UI under Certificates & Security → SSL Certificates: confirm fairssl-acme-cert exists with the new expiry date.
Under Virtual Services: confirm the chosen VS uses the new certificate.
Test publicly with FairSSL\'s SSL scanner.
If you previously used KEMP\'s built-in Let\'s Encrypt on the same VS, disable it to avoid parallel renewal.

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Why cannot KEMP fetch certificates directly from FairSSL?

KEMP LoadMaster ships a built-in "Let's Encrypt" integration, but its endpoint is hard-coded to the Let's Encrypt production server and cannot be redirected to FairSSL's ACME server. So we use the proxy approach: an external Linux or Windows host issues the certificate and pushes it to KEMP via the LoadMaster API.

What do you mean by "KEMP never sees the ACME challenge"?

The DNS-01 challenge is answered by FairSSL AutoDNS itself. You set a permanent CNAME from _dnsauth.<your-domain> to our DNS server, and FairSSL responds to the challenge. KEMP never exposes port 80 to the internet, and no DNS provider API access is needed. From KEMP's point of view, the certificate just arrives as a finished PEM ready to import.

Which KEMP version is supported?

LoadMaster firmware 7.2.48 and later has a full certificate management API. We have tested the flow on 7.2.55+. Older firmware may require manual upload via the web UI, which defeats the point of automation.

What kind of API user do I need on KEMP?

A dedicated API user with All Permissions for SSL Certificates and Real Servers / Virtual Services. Set the login method to Local User and use a strong password. If you use 2FA in the web UI, exempt the API user, since 2FA is not supported on API calls.

What happens at renewal?

Lego (or simple-acme) runs daily on the proxy host. When ARI or the built-in 7-day fallback triggers a renewal, a new certificate is fetched and the deploy script calls the KEMP API: POST /access/addcert to import the new certificate and POST /access/modvs for each Virtual Service that needs it.

Should I disable KEMP's built-in Let's Encrypt integration?

If you previously used KEMP's built-in Let's Encrypt on the same Virtual Services, yes - disable it in the KEMP UI. If it keeps trying to renew in parallel with our flow, the two approaches can compete over the same bindings and produce confusing results.

Ready to automate KEMP certificates?

Create a free account and issue your first certificate in under 10 minutes.

Create free account Compare certificates