Keith Smith - My Blog - Twitter @_KeithIT

Let's Encrypt redirect with KEMP load balancer

Sunday, November 10, 2019 - by Keith A. Smith

PKI Management is a huge PITA, in a near future I will post how I've automated PKI renewals and installation of certificates. In this post I wanted share a method managing certificate renewals in an environment that has multiple web servers and a KEMP load balancer in front with a central server for certificate management. The Load balancer rules will send traffic with the /.well-known/acme-challenge/ to the certificate management server and all other 80 traffic gets redirected to 443.


You will need to create a virtual service with two subVS's.




Open the virtual service then add the first SubVSs





The first subVS weight should be 1100 and Not Available Redirection Handling Error code set to 302 and the Redirect URL set to https://%h%s.




The second SubVS has a weight of 1000 and has the IIS server I use to create my Let's Encrypt certs set as the real server.





Create a content rule named Lets_Encrypt, Rule Type is Content Matching, Match Type is Regular Expression, Header Field is left blank, Matching String is /^\/.well-known/ and ignore case is checked.




Now enabled Content Switching at the VS. I then added all my Content rules for my domains to the first SubVS so they will be redirected to HTTPS then I added the Lets_Encrypt Content Rule to the second SubVS.




To download the exported file, visit my github repo https://github.com/KeithIT-Dev/Kemp






-End

  Share Post   

View Comments Comments


Leave a Comment