Skip to main content

KEMP003 - Kemp LoadMaster TLS/SSL Certificate Error

Agent error code #KEMP003 indicates that Knocknoc could not establish a trusted TLS connection to the Kemp LoadMaster. The LoadMaster's certificate could not be verified against Knocknoc host's trust store.

LoadMasters often ship with a self-signed management certificate, which will not validate against a public certificate authority.

Common causes include:

  • The LoadMaster presents a self-signed or otherwise untrusted management certificate
  • The certificate's hostname does not match the host in the Kemp LoadMaster URL
  • The certificate has expired

Steps to Resolve

Enable the Insecure Option

  1. If the LoadMaster uses a self-signed certificate, tick the Insecure option on the Knocknoc backend to skip certificate verification
  2. Save and retry

Install a Trusted Certificate

For production, prefer installing a certificate the Knocknoc host trusts rather than disabling verification:

  1. In the LoadMaster WUI, replace the management certificate with one signed by a CA Knocknoc host trusts
  2. Confirm the certificate's subject matches the host in the Kemp LoadMaster URL

Confirm From a Reachable Host

  1. Run: curl -sk -u '<username>:<password>' 'https://<loadmaster-host>/access/aclcontrol?list=white&apiformat=json'
  2. The -k flag skips verification. Removing it reproduces the TLS error and shows the underlying certificate problem

Still Having Issues?

We can help you out, contact us at [email protected].

Back to top