Generate CSR, enrol and install certificate using NetScaler

Whilst you may be familiar with generating a CSR using IIS, it is also possible to generate a CSR using NetScaler and from there submit a certificate request to a public or internal CA using that CSR to generate a certificate.

I’ll take for granted that you know the IIS method. So here, I will show:

1. Generating a private key and CSR on the NetScaler.
2. Handing the CSR to a Certificate Authority, in my case internal Active Directory Certificate Services.
3. Submitting a request for a certificate using the CSR.
4. Saving the certificate from the CA and installing on NetScaler.

First we generate a private key (RSA Key). On NetScaler, navigate to Traffic Management -> SSL -> SSL Files -> Keys -> Create RSA Key.

Specify a name for the RSA Key. The key file will be stored on NetScaler within /nsconfig/ssl/. Specify a key size (max 4096), PEM format, DES3 encryption and a PEM passphrase. Click Create. Now navigate to Traffic Management -> SSL -> SSL Files -> CSRs -> Create Certificate Signing Request (CSR). Enter a name for the request file. Browse the appliance and choose the RSA Key you created under Key Filename. Enter the PEM Passphrase you choose during the RSA Key creation. Under Digest Method choose SHA256. Continue to the lower part of the creation screen. Enter a Common Name, Organization Name, State or Province, and Country. Other fields are optional. The Challenge Password field for example is not used by ADCS however may be used for additional authentication with third party CAs so they can challenge you for authentication. Click Create. Navigate to Traffic Management -> SSL -> Manage Certificates / Keys / CSRs. Find the CSR you just created and click View. Copy the CSR contents and place in a .TXT file. Now hand the CSR TXT file to your Certificate Authority. In my case, internal ADCS. So for example I can run the following command to request a certificate using the CSR we just created. I’ll then be prompted to save the issued certificate. The certificate has been successfully issued and saved to my network share. I can now upload this certificate to NetScaler. On NetScaler navigate to Traffic Management -> SSL -> Certificates -> Server Certificates -> Install. Enter a certificate-key pair name. Under Certificate File Name browse for the certificate issued by your CA. Under Certificate File Name browse for the RSA Key you created which still resides on the NetScaler. Enter the RSA Key password. Click Install. Now you have a certificate which you can use against Load Balanced vServers or NetScaler Gateway vServers etc.