How to change Certificate on Progress Kemp LoadMaster

Learn how to manually replace an SSL certificate on Progress Kemp LoadMaster, preserve Virtual Service assignments, handle HA, and verify production traffic.

LoadMaster keeps certificates by identifier and assigns them to SSL-enabled Virtual Services. Its Replace Certificate operation updates the existing identifier and its Virtual Service use without a system reboot, although Progress recommends a maintenance window because production traffic can be affected.

Before you begin

Back up LoadMaster, record the certificate identifier, Virtual Service assignments and certificate order, intermediate certificates, administrative-certificate use, and HA status. Prepare a PFX or PEM supported by the appliance plus private key/passphrase.

Step-by-step certificate replacement

Go to Certificates & Security > SSL Certificates.
Locate the existing identifier and select Replace Certificate.
Upload the renewed .pfx or .pem; supply a separate key when required and enter its passphrase. Save.
Confirm the certificate remains assigned to all intended Virtual Services. If it was imported under a new identifier, move it from Available to Assigned for each Virtual Service and save. Preserve order where multiple RSA/ECC/SNI certificates are assigned.
In HA/FIPS deployments, follow the version's synchronization rules; Progress specifically says both HA nodes should be up for FIPS certificate import.

Product-specific considerations

Replacing an ordinary certificate does not require a reboot. ACME-managed Let's Encrypt/DigiCert certificates are replaced from the ACME Certificates screen, not the ordinary SSL Certificates list. Assigning a brand-new certificate to a Virtual Service can restart that Virtual Service, so perform it outside peak traffic.

Verify the new certificate

Check the identifier, expiry, intermediate chain, assignments, and HA health in WUI. Connect to every Virtual Service hostname with SNI and compare the served fingerprint.

Rollback

Use Replace Certificate with the backed-up PFX/PEM, or reassign the previous identifier to each Virtual Service. Confirm assignment order and traffic health.

Common problems

Wrong passphrase or an unsupported character/length in it.
Certificate imported but not assigned to the Virtual Service.
Intermediate certificates are missing.
Replacement changes the order of multiple assigned certificates.

Automating certificate replacement with aethercert

The aethercert Kemp target uploads a combined certificate/key bundle under the selected name and can bind it to a configured Virtual Service.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.