6.5.18 Kemp LoadMaster

Enable the API, grant certificate permissions, and preserve Virtual Service bindings

The Kemp LoadMaster (REST API) template creates or replaces a named SSL certificate and uploads intermediate certificates to the LoadMaster Intermediate Certificates store.

Enable API access

In LoadMaster, open Certificates & Security > Remote Access and enable the API interface. The agent host must reach the LoadMaster management address over HTTPS.

Use a LoadMaster account with:

  • Certificate Creation permission
  • Intermediate Certificates permission

Include the management port in LoadMaster management IP/hostname when it is not 443, for example lm.example.com:8443. The template tolerates a self-signed certificate on the management interface.

Use a stable certificate name

Set SSL certificate identifier to the certificate object already bound to the Virtual Services. The template replaces that object by name, so existing Virtual Service bindings continue to use the renewal without being recreated.

If the name does not exist, the template creates it. Bind the new certificate to the intended Virtual Services after the first deployment.

LoadMaster does not accept spaces in certificate identifiers. The template replaces spaces with dashes and reports the resulting name. Use the dashed name for bindings and future deployments to avoid ambiguity.

Intermediate certificates

The deployment format includes a separate intermediate chain. The template uploads missing chain certificates to the LoadMaster Intermediate Certificates store before creating or replacing the leaf certificate.

If clients receive an incomplete-chain error after a successful deployment, confirm the current CA intermediates appear in that store and that the deployed certificate was generated with the PEM (Cert + Key + Chain) format selected by the template.

Common problems

  • API request rejected: confirm API access is enabled and the account has both certificate permissions.
  • Virtual Service still uses the old certificate: confirm the template name exactly matches the certificate object bound to that service, including dash substitution.
  • Intermediate upload fails: verify the account has Intermediate Certificates permission in addition to Certificate Creation.

For a product overview, see certificate automation for Kemp LoadMaster.