SSL automation

ACME on appliances: native or proxy

Q: Do I need to open DNS API access to my DNS provider?

No. That is the whole point of FairSSL AutoDNS . You create a permanent CNAME once, and FairSSL handles every ACME DNS-01 challenge. No DNS API keys, no firewall openings towards the DNS server.

Firewalls, load balancers, mail gateways and monitoring servers typically cannot run an ACME client internally. We have done the setup on FortiGate, FortiMail, FortiWeb, NetScaler, F5 BIG-IP, KEMP and Kubernetes many times, and there are only two patterns you need to pick from.

Supported versions

The wizard in the control panel is written for these versions. If you run an older version than the one listed, ask us before you order.

Appliances

Platform	Versions	Runs on	ACME client	Guide
FortiGate	VersionsFortiOS 7.6.3 and newer	Runs onThe device itself	ACME clientThe device’s built-in ACME client with EAB	Guide →
FortiGate	VersionsFortiOS before 7.6.3	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + Posh-SSH, CredentialManager	Guide →
FortiGate	VersionsFortiOS before 7.6.3	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
FortiMail	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + Posh-SSH, CredentialManager	Guide →
FortiMail	VersionsThe guide sets no version limit	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
FortiWeb	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + FortiWeb REST API, CredentialManager	Guide →
NetScaler ADC	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + NITRO API, CredentialManager	Guide →
F5 BIG-IP	VersionsBIG-IP 21.1.0 and newer	Runs onThe device itself	ACME clientThe device’s built-in ACME client with EAB	Guide →
Kemp LoadMaster	VersionsLMOS 7.x and newer	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
Cisco FDM (Firepower)	VersionsFTD 6.4+	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+
Cisco ASA and devices without EAB	VersionsThe guide sets no version limit	Runs onThe device itself	ACME clientThe device’s built-in ACME client with a single-use enrollment URL, no EAB	Guide →
Kubernetes	VersionsThe guide sets no version limit	Runs onThe Kubernetes cluster	ACME clientcert-manager, ARI from v1.21 with the ACMEUseARI feature gate	Guide →

The two patterns

Native ACME

The appliance runs the ACME client itself

The appliance talks directly to the FairSSL ACME server, fetches the certificate and installs it in its own configuration. Shortest possible chain, fewest moving parts.

Supported today:

FortiGate from FortiOS 7.6.3
F5 BIG-IP has built-in ACME from 21.1.0.
Kubernetes via cert-manager

Proxy + push

External host issues, deploy-hook pushes

A small Linux or Windows host runs Lego or simple-acme. It issues the certificate via FairSSL AutoDNS, and a deploy-hook uploads it to the appliance via its API.

Used for:

FortiGate older than 7.6.3, FortiMail, FortiWeb
NetScaler / Citrix ADC
F5 BIG-IP before 21.1.0, KEMP LoadMaster
Palo Alto, pfSense, OPNsense, Ubiquiti

Appliances with ready-made guides

FortiGate

Native

7.6.3+ with native ACME, older versions via proxy

Native ACME client from FortiOS 7.6.3 with HTTP-01 validation on an arbitrary port. Older FortiGate versions get the certificate pushed in from a Linux or Windows host.

FortiMail / FortiWeb

Proxy

Proxy + REST API

A Lego or simple-acme host issues the certificate and pushes it in via the FortiMail or FortiWeb REST API. We have ready-made script templates for both.

Citrix NetScaler / ADC

Proxy

Proxy + NITRO API

simple-acme on a Windows host issues the certificate and deploys it to NetScaler via the NITRO REST API. Updates both the SSL certificate object and the bound virtual servers.

F5 BIG-IP

Native

ACME 21.1.0+ / Lego + iControl REST

Built-in ACME from BIG-IP 21.1.0. Use Lego and iControl REST on older versions. FairSSL handles domain validation with AutoDNS.

KEMP LoadMaster

Proxy

Proxy + KEMP API

The built-in Let's Encrypt integration cannot point at FairSSL. We use an external host with AutoDNS validation and KEMP's API to import and bind the certificate to virtual services.

Kubernetes

Native

Native ACME via cert-manager

cert-manager runs as an ACME client inside the cluster, creates a ClusterIssuer against FairSSL and issues TLS Secrets automatically. No proxy required.

All appliance and NAS guides →

How proxy + push works in practice

1

Pick a host

An existing Linux or Windows server. It only needs outbound internet access and network access to the appliance management port.
2

Create one CNAME for ACME validation

FairSSL AutoDNS uses a permanent _dnsauth.<your-domain> CNAME pointing to our DNS server. One-time setup. No DNS API keys required.
3

Run Lego or simple-acme with EAB keys

The client registers the account against the FairSSL ACME server, issues the certificate and stores it locally.
4

Deploy-hook pushes the certificate to the appliance

A bash or PowerShell script calls the appliance API (iControl, NITRO, FortiOS REST, KEMP API) and updates the certificate on the relevant virtual services.
5

Schedule the client daily

cron or Task Scheduler runs the client once a day. ARI controls when the actual renewal happens, and the deploy-hook fires only on an actual renewal.

Ready-made example scripts live inside each appliance guide above. Missing your appliance from the list? Email info@fairssl.dk and ask, we have done it before.

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain delivers certificates to firewalls and load balancers without an agent

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Which appliances can run ACME natively?

F5 BIG-IP has built-in ACME from 21.1.0. FortiGate has a built-in ACME client from FortiOS 7.6.3. cert-manager for Kubernetes is a native ACME client running inside the cluster. Everything else (NetScaler, F5 before 21.1.0, KEMP, FortiMail, FortiWeb, PRTG, Palo Alto, pfSense, OPNsense) needs an external host that issues the certificate and pushes it in via API or SSH.

What is the proxy approach?

You run an ACME client such as Lego or simple-acme on an existing Linux or Windows server. The client issues the certificate via FairSSL AutoDNS validation, and a deploy-hook or post-renewal script uploads it to the appliance via its API. The appliance never sees the ACME challenge.

How does it work with KEMP LoadMaster?

KEMP has a built-in "Let's Encrypt" integration that is hard-pointed at Let's Encrypt's production server and cannot be redirected to the FairSSL ACME server. We recommend the proxy approach: issue the certificate on a Linux or Windows host using AutoDNS validation, then use KEMP's API to import the certificate and update the virtual services.

Do I need to open DNS API access to my DNS provider?

No. That is the whole point of FairSSL AutoDNS. You create a permanent CNAME once, and FairSSL handles every ACME DNS-01 challenge. No DNS API keys, no firewall openings towards the DNS server.

Is ARI supported on appliances?

Yes, through the external ACME client. ARI (RFC 9773) is a property of the client, not the appliance. Both Lego (v5+) and simple-acme support ARI, and the FairSSL ACME server exposes ARI endpoints. If FairSSL needs to re-issue the certificate, your client renews it automatically within the window ARI indicates.

Can you help with the setup?

Yes. Order installation service from the control panel and a FairSSL technician will help get the proxy script in place. We have done the setup on FortiGate, FortiMail, NetScaler, F5, KEMP and many other appliances before.

Ready to automate certificates on your appliances?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates