Replace an SSL Certificate on Kemp LoadMaster

LoadMaster stores each certificate under a Certificate Identifier and assigns it to SSL-enabled Virtual Services. Its Replace Certificate function swaps the certificate behind an existing identifier, so every Virtual Service that uses it keeps the assignment. No reboot is needed, but Progress notes that replacing a certificate does affect production traffic, so plan a maintenance window.

Before you beginCopy Anchor Link

• Back up the LoadMaster configuration, and keep the PFX/PEM file of the current certificate - Replace Certificate overwrites it, and that file is your rollback.

• Record the certificate identifier, every Virtual Service it is assigned to (and the order where several certificates are assigned), the intermediate certificates and the HA state.

• Prepare the renewed certificate as PFX or PEM - the only formats Replace Certificate accepts - with the private key in the file or as a separate key file.

• Check the pass phrase: according to Progress, it must be alphanumeric, case-sensitive and at most 64 characters. Symbols such as ! or # - common in PFX passwords - make the import fail. Re-export the PFX with a compliant pass phrase:

  Copy Text

  openssl pkcs12 -in old.pfx -nodes -out temp.pem
  openssl pkcs12 -export -in temp.pem -out loadmaster.pfx

  Enter an alphanumeric pass phrase when asked, and delete temp.pem afterwards - it contains the unencrypted key.

• Check the file name: it must not contain ident, cfile, kfile, ffile, replace or password, which LoadMaster reserves.

• Certificates issued through LoadMaster's ACME client (Let's Encrypt, DigiCert) are not replaced here; they are managed under Certificates & Security > ACME Certificates.

Step-by-step certificate replacementCopy Anchor Link

1. Go to Certificates & Security > SSL Certificates.
2. Find the certificate and click Replace Certificate.
3. Under Certificate File, click Choose File and select the renewed .pfx or .pem file. If the key is not in that file, also select the Key File.
4. Enter the Pass Phrase and click Save.
5. If the new certificate comes from a different intermediate CA, add the intermediate under Certificates & Security > Intermediate Certs > Add New (before or after the replacement - it takes effect once both are present). PEM, CER and CRT files are supported, and a file containing several intermediates is split automatically. LoadMaster builds the chain itself; intermediates are not assigned to Virtual Services.
6. Back on SSL Certificates, confirm the certificate is still assigned to every intended Virtual Service.

Importing under a new identifier insteadCopy Anchor Link

Use this if you want the old and new certificate side by side, for example to move one Virtual Service at a time. If you import the certificate as a new one (Import Certificate, with a new Certificate Identifier), it is not used until you assign it: select the Virtual Services in the Available VSs list, move them across with the arrow and click Save Changes - or assign it in the Virtual Service's own settings. Keep the order of certificates where a Virtual Service has several (for example RSA and ECC, or SNI).

Verify the new certificateCopy Anchor Link

In SSL Certificates, check the identifier, expiry date and assignments. Then connect to every Virtual Service hostname:

openssl s_client -connect app.example.com:443 -servername app.example.com -showcerts </dev/null

Check subject and SAN, issuer, expiry date and that the intermediate is sent. Progress does not quantify the traffic impact of a replacement, so watch the Virtual Services' status and your monitoring during the change. In an HA pair, confirm on both units that the new certificate is present before relying on a failover.

RollbackCopy Anchor Link

Run Replace Certificate again with the backed-up PFX/PEM, or - if you imported under a new identifier - assign the previous identifier to each Virtual Service again. Restore the backup if the configuration is in doubt.

Common problemsCopy Anchor Link

• The pass phrase contains non-alphanumeric characters or is longer than 64 characters.
• The file name contains a reserved word and the import is rejected.
• A certificate imported under a new identifier was never assigned to the Virtual Service.
• The intermediate certificate is missing.
• An ACME-managed certificate was looked for on the SSL Certificates screen.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert Kemp target uploads a combined certificate/key bundle under the selected name and can bind it to a configured Virtual Service.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Progress: replacing a certificate on LoadMaster
• Progress: adding an SSL certificate
• Progress: importing intermediate certificates