Citrix NetScaler VPX: Install Your SSL Certificate. If you have not yet created your RSA key and certificate signing request (CSR) and ordered your certificate, see Citrix NetScaler VPX: Create Your CSR (Certificate Signing Request).

NetScaler, XenMobile and SSL certificates

So, you’ve finally decided to make yourself 'a small Citrix lab' (XenMobile and NetScaler), but you’re having trouble with getting all the certificates in place. Fear not, I’m here to help!

Installing the SSL certificates for NetScaler is relatively simple, but still… some steps are easily forgotten and then… you need to troubleshoot. Generate fingerprint from public key online.

Steps to install the SSL certificate for NetScaler (correctly) are:

While working with Citrix NetScaler appliances i am requesting new public signed certificates every so often. However sometimes you might want to test your configuration first before buying the certificates. One way of doing this is with selfsigned certificates, another is with a free SSL service like Let’s Encrypt. Let’s Encrypt is a free, automated,. On the Private Key tab, expand Key Options, and make sure Mark private key as exportable is checked. Then finish Enrolling the certificate. Export the certificate and Private Key to a.pfx file. On the NetScaler, if you want to encrypt the private key, then use the Traffic Management SSL Import PKCS#12 tool to convert the.pfx to PEM format. I recommend importing and converting the PFX to PEM since this will encrypt your key file. Netscaler 11 does allow a slightly faster method to install new certificates, but the key is not encrypted. This import and installation method below will encrypt your key file. Login to your Netscaler. Go to Configuration Traffic Management SSL. May 12, 2016  Replacing default certificates for management on SDX Ask question. From what I have read the best practise it to not use the default installed cert/key pair but to generate/obtain your own. In our case we will be planning to create a key pair/CSR from each VPX instance to be signed off by our own internal CA and then uploading the.

1. Install the server certificate (for example, certificate for xms.yourdomain.com). The easiest way is to use .PFX certificate file, and you can install it through Traffic Management – SSL – Certificates – Server Certificates.
2. Install the issuing and root CA’s certificates (.PEM files are OK) through Traffic Management – SSL – Certificates – CA Certificates.
3. Create link (right click – Link) between the server certificate and issuing CA’s certificate.
4. Create link (right click – Link) between the issuing CA’s certificate and root CA’s certificate.
5. Check the certificate links on issuing CA’s certificate (right click – Certificate links). There should be two – one linking the server certificate, another the root certificate.
6. Select the imported certificate for NetScaler Gateway usage.
7. Select the imported certificate for (SSL) virtual servers as well. If you’re using NetScaler appliances in HA mode, force synchronization.
8. Check if certificates are installed properly (for example, by opening the MAM interface with your browser – https://mam.yourdomain.com/ or https://mam.yourdomain.com:8443/).
9. Check if certificate chain is in order as well – https://www.digicert.com/help/.

For XenMobile Server, there is some preparation work to do, to get it all right. Basically, you’ll need to combine all the (.PEM) certificate files into one, upload that to XenMobile Server, and restart.

Win 8.1 64 bit key generator. Steps are:

1. Combine individual (.PEM) certificate files (server, issuing and root CA) into one .PEM file by following instructions on this DigiCert site (you can use Notepad to achieve this). Your final .PEM file should look like this:

-----BEGIN CERTIFICATE-----
(server_certificate.pem content)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(issuing_ca_certificate.pem content)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(root_ca_certificate.pem content)
-----END CERTIFICATE-----

2. Upload the combined (.PEM) certificate file to XenMobile Server.
3. Restart all the XenMobile Server nodes (one by one).
4. Check if nodes picked up the certificate change (for example, by opening the XenMobile Server management interface with your browser – https://{node's_IP_address}:4443).
5. Check if certificate chain is in order as well – https://www.digicert.com/help/.

And… that’s it!

Oh, yeah – in case you’ve been living under a rock… don’t use the SHA-1 certificates anymore… they are obsolete now (info).

Cheers!

Internal Failure In Ssl Cert/key Generation Tool Netscaler