Kemp LoadMaster

​

Prerequisites

• A Kemp LoadMaster Connection with API access
• The LoadMaster must be reachable over HTTPS from Infisical, either directly or through an Infisical Gateway
• The API Interface must be enabled on the LoadMaster (Certificates & Security > Remote Access > Enable API Interface)
• A user account with permission to manage SSL certificates and, if you bind to a Virtual Service, to modify Virtual Services

​

Create a Kemp LoadMaster Sync

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/kemp-loadmaster \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-kemp-cert-sync",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "an example certificate sync",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "destination": "kemp-loadmaster",
    "isAutoSyncEnabled": true,
    "certificateIds": [
        "550e8400-e29b-41d4-a716-446655440000"
    ],
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveItemOnRenewal": true,
        "certificateNameSchema": "Infisical-{{certificateId}}"
    },
    "destinationConfig": {
        "virtualServiceId": "1"
    }
}'

{
    "pkiSync": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-kemp-cert-sync",
        "description": "an example certificate sync",
        "destination": "kemp-loadmaster",
        "isAutoSyncEnabled": true,
        "destinationConfig": {
            "virtualServiceId": "1"
        },
        "syncOptions": {
            "canRemoveCertificates": true,
            "preserveItemOnRenewal": true,
            "certificateNameSchema": "Infisical-{{certificateId}}"
        },
        "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "550e8400-e29b-41d4-a716-446655440000",
        "createdAt": "2026-03-31T00:00:00.000Z",
        "updatedAt": "2026-03-31T00:00:00.000Z"
    }
}

​

Certificate Management

• Automatic Deployment: Import certificates from Infisical into the LoadMaster certificate store with customizable naming.
• Certificate Updates: Replace certificates on the LoadMaster when renewals occur.
• Virtual Service Binding: Optionally bind certificates to a Virtual Service, alongside any certificates the LoadMaster already serves there.
• Expiration Handling: Optionally remove expired or revoked certificates from the LoadMaster (if enabled).

​

How It Works

• Uploads certificates, with their chains and private keys, to the LoadMaster.
• Uploads the intermediate CA certificates into the LoadMaster’s Intermediate Certs store so clients receive the complete trust chain.
• Optionally binds them to a Virtual Service for HTTPS termination.
• Optionally removes certificates that are no longer active in Infisical.

​

Certificate Renewal Behavior

• Preserve enabled (default): The renewed certificate reuses the original certificate’s identifier and replaces that entry in place, so the name and any Virtual Service binding are preserved. This matters when your name schema is certificate-specific (for example it includes {{certificateId}}, which would otherwise resolve to a new name on renewal). Ideal for production environments.
• Preserve disabled: The renewed certificate is imported under a newly generated identifier, and the original certificate remains on the LoadMaster until it is revoked or removed.

​

Removing Certificates

1. If a Virtual Service is configured, the certificate is removed from that Virtual Service’s bound certificate list.
2. The certificate is deleted from the LoadMaster certificate store.

​

Manual Certificate Sync

• Initial setup when you have existing certificates to deploy
• One-time sync of specific certificates
• Testing certificate sync configurations
• Force sync after making changes

​

FAQ

​

What’s Next?