KEMP LoadMaster: SSL certificate via ACME proxy

KEMP's built-in Let's Encrypt integration cannot point to FairSSL. Lego on a proxy host issues the certificate and transfers it to KEMP over the API.

How it works

1. 1 Create an API user on KEMP A local user with All Permissions for SSL Certificates and Virtual Services, exempt from 2FA.
2. 2 Install Lego and the deploy script on the proxy host The script builds a PEM bundle and calls /access/addcert and /access/modvs on KEMP.
3. 3 Issue and schedule Run Lego once with the EAB keys and FairSSL AutoDNS, and schedule a daily run with cron. ARI drives renewal.
4. 4 Check In the LoadMaster UI, fairssl-acme-cert must carry the new expiry date and be used by the Virtual Service. Test with FairSSL's SSL scanner.

← All guides

Setup

Step 1: Create an API user on KEMP

In the LoadMaster UI: go to System Configuration → User Management and create a local user (e.g. acme-deploy) with All Permissions for SSL Certificates and Virtual Services. Use a strong password and record it - we store it in a credentials file on the proxy host. Exempt the user from 2FA if you use it, since API calls do not support 2FA.

Step 2: Install Lego on the proxy host

Use Lego v5.0.4 or newer. The following command fetches the latest release and installs the binary to /usr/local/bin/lego.

arch=$(dpkg --print-architecture)
case "$arch" in amd64|arm64) ;; *) echo "Adjust arch"; exit 1 ;; esac
version=$(curl -fsSL https://api.github.com/repos/go-acme/lego/releases/latest \
  | sed -n 's/.*"tag_name": "\(v[^"]*\)".*/\1/p' | head -1)
curl -fL "https://github.com/go-acme/lego/releases/download/${version}/lego_${version}_linux_${arch}.tar.gz" \
  | sudo tar -xz -C /usr/local/bin lego
sudo install -d -m 0700 /etc/ssl/kemp

Step 3: Create the deploy script

The script builds a PEM bundle (certificate + chain + private key), uploads it to KEMP via /access/addcert and binds it to the chosen Virtual Service via /access/modvs.

sudo tee /usr/local/bin/kemp-deploy.sh > /dev/null << 'SCRIPT'
#!/bin/bash
set -euo pipefail
KEMP_HOST="lb.example.com"
KEMP_USER="acme-deploy"
KEMP_PASS="YOUR_API_PASSWORD"
CERT_NAME="fairssl-acme-cert"
VS_INDEX="1"   # Virtual Service ID (look up in KEMP UI under "Virtual Services")

CERT="$LEGO_HOOK_CERT_PATH"
KEY="$LEGO_HOOK_CERT_KEY_PATH"
BUNDLE=$(mktemp)
cat "$CERT" "$KEY" > "$BUNDLE"

# Upload (replace=1 overwrites an existing cert with the same name)
curl -sS -k --user "$KEMP_USER:$KEMP_PASS" \
  --data-binary "@$BUNDLE" \
  "https://$KEMP_HOST/access/addcert?cert=$CERT_NAME&replace=1"

# Bind the certificate to the Virtual Service
curl -sS -k --user "$KEMP_USER:$KEMP_PASS" \
  "https://$KEMP_HOST/access/modvs?vs=$VS_INDEX&certfile=$CERT_NAME"

rm -f "$BUNDLE"
SCRIPT
sudo chmod +x /usr/local/bin/kemp-deploy.sh

Step 4: Issue the certificate

Make sure the domain is configured for FairSSL AutoDNS. Run Lego once with the EAB keys.

sudo /usr/local/bin/lego run \
  --domains "lb.example.com" \
  --server https://fairssl.dk/acme \
  --eab --eab.kid YOUR_EAB_KID --eab.hmac YOUR_EAB_HMAC \
  --accept-tos --email acme-client@fairssl.dk \
  --http --http.webroot "/var/www/html" \
  --path "/etc/ssl/kemp" \
  --deploy-hook "/usr/local/bin/kemp-deploy.sh"

Step 5: Schedule daily with cron

# /etc/cron.d/lego-kemp
17 04 * * * root /usr/local/bin/lego run \
  --domains "lb.example.com" \
  --server https://fairssl.dk/acme \
  --accept-tos --email acme-client@fairssl.dk \
  --http --http.webroot "/var/www/html" \
  --path "/etc/ssl/kemp" \
  --renew-days 7 \
  --deploy-hook "/usr/local/bin/kemp-deploy.sh"

Step 6: Verify

• In the LoadMaster UI under Certificates & Security → SSL Certificates: confirm fairssl-acme-cert exists with the new expiry date.
• Under Virtual Services: confirm the chosen VS uses the new certificate.
• Test publicly with FairSSL's SSL scanner.
• If you previously used KEMP's built-in Let's Encrypt on the same VS, disable it to avoid parallel renewal.