For more details, please see ourCookie Policy.

vADC Blog

Using Let's Encrypt certificates with Brocade vADC

by Baptiste Assmann on ‎01-19-2017 10:05 AM - last edited on ‎05-16-2017 04:55 AM by PaulWallace (10,177 Views) is a free and automated Certificate Authority that makes it easy for organizations to secure websites. It can set up TLS certificates very easily, limited to one domain name (i.e., and has the advantage that it supports both RSA and ECC certificates.


In this article, we show an example of how to configure Let’s Encrypt to work with Brocade vADC, including:

  • Issue new certificates
  • Automated renewal of certificates
  • Install certificates and tools
  • Use both RSA and ECC for performance and maximum compatibility
  • Enable automatic OCSP stapling



Let’s Encrypt relies on the ACME protocol for Automated Certificate Management Environment, which was developed with automation in mind:


  • The software client connects to Let’s Encrypt to issue or renew a certificate
  • An authorization/signature happens to verify you are the owner of the domain
  • The certificate is generated and sent back to the software client


We'll use an open source client ( to manage communications with Let’s Encrypt and we install a short script ( into Brocade vTM, which is used to issue and renew certificates. Then, we use the Brocade vTM alerting and scripting to trigger certificate renewal automatically through the open source script ( to talk to The steps are as follows:


  1. Install the open-source client
  2. Install our action script (
  3. Create a new action type for Brocade vTM
  4. Create a new alert for Brocade vTM
  5. Create a resource pool to manage responses from
  6. Create a TrafficScript rule to manage responses from




Installation procedure

This installation procedure can be applied the same way if you're running the Brocade vTM appliance or the Brocade vTM software on your own Linux distribution.



First, we need to download the open source component to manage the ACME protocol. Login as admin into your vTM through SSH, then run the following commands:


curl -LO
chmod +x
./ --install --nocron


More options are available when installing For more information, please read



Next, we need to download and install the short script that is used to issue and renew certificates and communicate with the component.



This script can be run manually to issue a new certificate and insert into Brocade vTM, but we need to load it into the Brocade vTM Catalog, so that it can be called automatically to renew certificates.


  • Connect to the Brocade vTM Web UI, then navigate to
    Catalogs > Extra Files > Action Programs
  • Click on the Choose File button and point to the script
  • Click on the Upload Program button



Set up a new Action

Now, we need to create a new action, which will be called when a certificate is about to expire.


  • Connect to the Web UI, then navigate to System > Alerting
  • Click on the Manage Actions link
  • Complete the "Create new action" form:

 Name: letsencrypt_renewal

 Type: Program




  • Click on Add action
  • On the next page, in Additional Settings:

Program: choose

  • Click on the Updatebutton at the bottom of the page



Create a new Alert mapping

In Brocade vTM, an alert maps an event to an action. In our case, we'll match the event "Certificate is about to expire" to the action we've created at the step before.


  • Connect to the Web UI, then browse System> Alerting
  • In Select Event Type, choose SSL Certificate Expiry
  • As an action, choose letsencrypt_renewal



Note: the SSL Certificate Expiry will match for all certificates configured into Brocade vTM, whether or not they were issued by Let’s Encrypt. It is possible to create a copy of this event, named SSL Certificate Expiry Lets Encrypt and match only the vservers where your Let’s Encrypt certificates are enabled.


Create a pool for the script

The purpose of this pool is to send ping back from Let’s Encrypt. While we are running, we will need to make it listen for http requests on port 88.

Note that once the certificate has been renewed or issued, then will shutdown the port.


  • Connect to the Web UI, then browse Services > Pools
  • Complete the Create a new pool form as below:

Pool name: p_letsencrypt


Monitor: Ping


  • Click on the Create Pool button



Create a new TrafficScript rule

The purpose of this rule is to route ping back from to the pool which we created (p_letsencrypt) - which itself will route the request to the script.


  • Connect to the Web UI, then browse Catalogs > Rules
  • Complete the Create a new rule form with the following information:


Check the Use TrafficScript Language

Click on the Create Rule button

  • In the next page, complete the form as below:

Notes: Route traffic related to (letsencrypt)

Rule: As shown here:

$path = http.getPath();
if( string.containsI( $path, "acme-challenge" ) ) {   

  • Click on the Update button
  • Later, you will add this rule to the vserver for your application




Complete your environment

If you have not already set up your application with a vserver, you will need to create a vserver listening on port 80 on the IP address pointed by the domain for which you are issuing the certificate.


Now you can enable the TrafficScript rule into the vserver which is managing the domain. This should be one of the first rules in the list.


Generate a new certificate

In order to generate a new certificate for our application, we need to run the script to request a new certificate from Let’s Encrypt:


  • Connect to vTM using ssh
  • Run the following command for an ECC certificate:
./ --issue c_www.domain.com_ecc


  • Alternatively, run this command to request an RSA certificate:
./ --issue c_www.domain.com_rsa


The new certificate is automatically inserted into Brocade vTM, which you can confirm by navigating to Catalogs > SSL. You can now navigate to your vserver, enable SSL offloading and select the new certificate.


Let’s Encrypt certificate chain

The script takes care of this task for you. When inserting the certificate into Brocade vTM, the script uses the full chain, including the certificate for the domain and the required intermediaries.


Renew a Let’s Encrypt certificate

When the certificate is due for renewal, our script should take care of the certificate renewal. Seven days before expiration, the alert mapping will run the script with the name of the certificate as an argument.

If, for some reasons, Let’s Encrypt is not available at the first execution, Brocade vTM will attempt to call every hour until the certificate is renewed.


OCSP stapling

Brocade vTM can use information available in the certificate to process OCSP stapling automatically. This feature works out of the box with Let’s Encrypt certificates.


All you need to do is to enable ssl_ocsp_stapling in your vserver when configuring SSL Decryption.




Using the TEST environment variable

It is highly recommended to use the Let’s Encrypt test / staging environment during the installation phase. Otherwise, Let’s Encrypt may blacklist your domain if you generate too many certificates.


In order to use the test environment, edit script and search for the TEST variable: uncomment the TEST variable and re-upload the script into Catalogs > Extra Files > Actions.


Once the full procedure is validated and you want to move to production, simply comment out the TEST variable line and re-upload the script into Catalogs > Extra Files > Actions.


by ArnaudM
‎05-11-2017 06:59 AM - edited ‎05-11-2017 07:00 AM



In vTM 10.4r1, this is not possible to name an Event Type with a quote, so I'd edit the following note not to suggest calling it "SSL Certificate Expiry Let’s Encrypt"


Otherwise you can't create an Alert Mapping.



Note: the SSL Certificate Expiry will match for all certificates configured into Brocade vTM, whether or not they were issued by Let’s Encrypt. It is possible to create a copy of this event, named SSL Certificate Expiry Let’s Encrypt and match only the vservers where your Let’s Encrypt certificates are enabled.



by PaulWallace
on ‎05-16-2017 04:56 AM

Thanks ArnaudM, well spotted - let me know if the correction is ok


by ArnaudM
on ‎05-16-2017 05:19 AM

Yes this is fine

by ubabiak
‎08-17-2017 01:53 AM - edited ‎08-17-2017 05:04 AM

@Baptiste Assmann wrote:

This installation procedure can be applied the same way if you're running the Brocade vTM appliance or the Brocade vTM software on your own Linux distribution.


First of all thank you for developing this lets-encrypt-workaround. 


An annotation for anyone who follows these step-by-step-instructions:


I set up and tested  the process with the TEST variable enabled. Even after disabling TEST for production, I kept getting test certificates ("CN=Fake LE Intermediate X1" ) for the domains that i used during the test. Probably was caching some values? Since I didn't have the time for extended debugging, I simply deleted the directory and re-installed From then on, correct production certs were generated.



Now I wonder  how to  protect the letsencrypt setup from being erased on every system upgrade if using the (virtual/VMware) Appliance ? Currently, I am hiding my custom stuff inside a directory on the /logs/ partition .... But maybe  the next update already contains the native LetsE-Support  so no protection is needed?



by lbasp
on ‎10-24-2017 04:32 AM

the latest uses socat instead of nc and the vtm 17.3 does not provide this package. does anybody already has a workaround for this?

by tenajsystems
on ‎10-25-2017 06:26 AM

If I wanted to generate a cert for a domain that had an alias (example: and alias, how would I accomplish this? 

by tenajsystems
on ‎10-25-2017 10:02 AM

@lbasp assuming you are running ubuntu, you can install socat by using command: "sudo apt-get update && sudo apt-get install socat"

by PaulWallace
on ‎10-25-2017 04:56 PM

Thanks @tenajsystems - you can install socat under the open access policy for the Virtual Appliance. We may also review the install profile of the Virtual Appliance for future releases. Thanks!


by lbasp
on ‎10-25-2017 11:42 PM


by tenajsystems
on ‎10-26-2017 09:01 AM

@PaulWallace, when I run the script "./ --issue c_example.com_rsa" Its able to request for the cert and everything is successful but I am getting the errors below:
Broken installation: missing components.
Broken installation: missing components.


As a result, the cert is not uploading into the VTM catalog. What I'm I missing? I am running VTM version 17.3

by tenajsystems
on ‎10-26-2017 01:34 PM

Regarding my previous comment on the error about "Broken installation: missing components". I figured out what was causing it. I forgot to delete the brocade VTM installer after I installed VTM so the find command in the script to locate zcli was finding both the zcli from the installer and the zcli tool on the system and couldn't figureout which zcli tool to use. After I deleted the VTM installer, the error went away.