Automated SSL certificate renewal for A10 Thunder

ACOS won't put a renewed certificate into a Client SSL template on its own. CertKit will.

An A10 Thunder serves TLS from Client SSL templates. Each template names a certificate, key, and chain from the SSL Management store, and every virtual port that uses the template serves them. A renewed certificate does nothing until someone imports it and swaps it into each template. Every 47 days. On every Thunder you manage.

CertKit issues and renews the certificate centrally, then the CertKit Agent uploads it over aXAPI, swaps it into the templates you list, and saves the configuration.

Start free trial Watch demo

Built for A10 Thunder

Pre-built templates for Client SSL templates and the management web UI ship in your CertKit account. No scripting required.

On every renewal, the agent signs in to aXAPI and uploads the key, certificate, and chain under a new name. It points each Client SSL template you list at the new files, reads every template back, and runs write memory. Virtual ports that use those templates switch over without a reload.

Point CertKit at your Thunder once and it handles every renewal after that. If you want to see or adjust what runs, the full deployment script is in your account.

How to install an SSL certificate on A10 Thunder

The manual process, if you want to do it yourself:

Get the certificate with its chain. Generate a key and certificate request (CSR) and submit it to your certificate authority. The same flow covers a wildcard certificate.
Import the key and certificate. Under ADC → SSL Management, choose Import. Import the private key as a Key, then the certificate as an SSL Certificate in PEM format, then the intermediate the same way.
Find the Client SSL template. Under ADC → SLB → Virtual Servers, open the HTTPS virtual port and note its Template Client SSL. Every virtual port that uses that template gets the change.
Swap the certificate in the template. Add the new certificate, key, and chain to the template before you remove the old pair. Remove the old pair first and ACOS refuses with "Can't remove certificate, template is currently in use." Check the SNI server-name entries too.
Save and repeat. Save the configuration with write memory in each partition you changed. Repeat on the other unit of an HA pair, and under System → Settings → Certificate if the web GUI uses the same certificate.

Every one of these steps is manual, and ACOS won't repeat any of them when the certificate renews. With lifetimes shrinking to 47 days, that's twelve times a year, on every Thunder. Miss the second unit of an HA pair and the expired certificate waits there for the next failover.

At 47 days, automation is the only sustainable way to run A10 Thunder certificates. Here's how CertKit does it.

CertKit has been a fantastic solution for automating our environment’s SSL/TLS certificates. With a single pane of glass for centralized management, visibility, and monitoring and the highly customizable interface for granular control over individual systems, we have found great value in reducing the time and complexity of managing an ad-hoc ACME solution for individual certificate automation.

Seth Allums, Lead Systems and Information Security Engineer, Clackamas Community College

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │CertKit Agent├──┼────►│  Issue & Renew   │◄──►│             │
│  └──┬────┬─────┘  │     │   Certificates   │    │             │
│     │    │aXAPI   │     │                ┌───┐  └─────────────┘
│     │    │ HTTPS  │     └───────────┬────│DNS│
│     ▼    ▼        │                 │    └───┘
│ ┌──────────────┐  │                 │
│ │ A10 Thunder  │  │                 │
│ │ [x] Uploaded │  │                 │
│ │ [x] Swapped  │  │ ◄───────────────┘
│ │ [x] Saved    │  │       Verify
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally using delegated DNS validation. You create a one-time CNAME record, and CertKit handles every ACME challenge after that.

The CertKit Agent runs on a Windows server inside your network. It pulls each renewal from CertKit over outbound HTTPS, then calls aXAPI on the Thunder's management address. The Thunder never talks to CertKit, never runs ACME, and never holds DNS credentials. One agent can reach every Thunder on that network. CertKit never connects into your network.

Two places a Thunder uses a certificate

A Thunder keeps the certificate for application traffic apart from the one for its own management interface. CertKit has a template for each, and you add the ones you use.

Client SSL templates Default and SNI certificates for virtual ports Management interface Web GUI and aXAPI, web-service-cert-key

A Client SSL template can hold more than one default certificate, such as an RSA and an ECDSA pair. ACOS swaps a new certificate in for the one with the same key type. A renewal with a different key type lands next to the old certificate instead of replacing it, so the agent removes the old one afterward and warns if ACOS won't let it. The management certificate works differently. ACOS restarts its web service to load it, so open GUI pages may need a refresh.

What CertKit handles

Issue and renew centrally. The one-time CNAME covers every renewal challenge. Your Thunders have no ACME configuration and need no inbound access from the internet.
Upload under a new name. The key, certificate, and chain go up over aXAPI as new "certkit-" files, so the files serving traffic are never overwritten in place.
Swap into every Client SSL template you list. Default certificates and SNI server-name entries that hold an earlier CertKit upload get the new files. Templates in an L3V partition work too.
Check before reporting success. The agent reads each template back and fails the deployment if it doesn't reference the new certificate. For the management interface, it waits until the Thunder serves the new one.
Save and clean up. The agent runs write memory, then deletes older CertKit uploads of that certificate once no template uses them. Certificates CertKit didn't upload are never deleted.
Alert on failure. A failed upload, a rejected template change, or a certificate that never appears raises an alert before it becomes an outage.
Audit every change. Every issuance, renewal, and deployment is logged. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit.
Create an A10 admin. Give it write access to SSL files and Client SSL templates in the partition. The management template needs an admin with global write privilege.
Install the CertKit Agent. One command on a Windows host that can reach the Thunder's management address over HTTPS. No extra PowerShell modules are needed.
Add the A10 Thunder deployment script. Choose the Client SSL Template or Management Web UI template, then enter the management address, credentials, and template names. For an HA pair, add a deployment for each unit.

See the full architecture →

A10 Thunder deployment requirements and troubleshooting →

Why not use the ACOS ACME client?

ACOS has an ACME client that can fetch certificates from Let's Encrypt. Getting the certificate is the easy half. On ACOS 5.2.1, users report (and A10 support confirmed) that a renewed ACME certificate shows as bound while the Client SSL template keeps serving the old one. Someone still has to remove the certificate from the template and add it back. The client also validates over HTTP-01 through a virtual port on port 80, so internal VIPs and wildcard certificates are out of reach.

CertKit issues the certificate through delegated DNS validation, which covers internal names and wildcards, and the agent finishes the job inside the template, with no ACME client on the load balancer.

A10 Thunder is just one part of your application delivery stack

Most networks have more than one place where TLS certificates live, including other load balancers like F5 BIG-IP, Kemp LoadMaster, and Citrix NetScaler. CertKit automates all of them from one account.

See all integrations

Start automating A10 Thunder certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing