Skip to content

Provision certificates to Kemp Virtual LoadMaster

Provision a certificate from Certificate Manager - SaaS to a Kemp LoadMaster. Certificate Manager - SaaS installs the certificate, its private key, and its issuing chain on the LoadMaster, and then adds the certificate to an existing virtual service.

Before you begin

  • A Kemp Virtual LoadMaster machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • A virtual service on the Kemp LoadMaster that already exists. Certificate Manager - SaaS doesn't create virtual services. You need the service's IP address, port, and protocol.

To provision a certificate to Kemp Virtual LoadMaster

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in Certificate Name, enter the name for the certificate on the Kemp LoadMaster. Use only letters (A-Z, a-z), digits (0-9), hyphens (-), underscores (_), and periods (.).

    If a certificate with that name already exists on the LoadMaster, Certificate Manager - SaaS checks whether it's the same certificate:

    • If it's the same certificate, Certificate Manager - SaaS uses the existing one.
    • If it's a different certificate, Certificate Manager - SaaS creates a unique name by appending the certificate's expiration date (YYMMDD) and the last four digits of its serial number, for example my-cert-name-251005-3117.

  6. (Optional) Under Installation Endpoint, in Virtual Service Name, enter the name of the virtual service for your reference. Certificate Manager - SaaS doesn't use this name to find the service. It finds the virtual service by its IP address, port, and protocol. For a certificate found by discovery, this field already contains the service's name.

  7. In Virtual Service IP Address, enter the IP address of the virtual service.
  8. In Service port, enter the port of the virtual service. The default is 443.

  9. For Protocol, choose TCP or UDP to match the virtual service. Make this choice explicitly, even if a value seems to be selected already.

  10. (Optional) To require clients to send a Server Name Indication (SNI) hostname, enable Require SNI hostname.

  11. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  12. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. When the certificate is pushed, Certificate Manager - SaaS installs the issuing chain as intermediate certificates and the certificate with its private key. It then finds the virtual service that matches the IP address, port, and protocol, turns on SSL acceleration for it, and adds the certificate to the service's certificate list. On a renewal, the new certificate replaces the one this installation added before, and the service's other certificates stay. If no virtual service matches, provisioning fails with a "Virtual service not found" error. To provision on a schedule instead of right away, set up a machine provisioning schedule.