Skip to content
Docs sslbrain sslbrain.com

Citrix NetScaler / ADC

Copy link to the page “Citrix NetScaler / ADC”

← All integrations

Load balancer · Firewall and VPN

Updates cert-key pairs and vserver bindings and saves the configuration.

The appliance runs the package and connects to Citrix NetScaler / ADC through NITRO API over HTTPS on port 443. No agent is installed on Citrix NetScaler / ADC.

What happens

  1. The appliance connects to Citrix NetScaler / ADC through NITRO API on port 443.
  2. The PEM files are uploaded and the cert-key pair is created or updated.
  3. The pair is bound to the chosen vservers and the configuration is saved. If it fails: Rollback puts the previous cert-key state back.
  4. Verification: the package reads back the cert-key pair and bindings and tests the certificate each vserver VIP serves over TLS.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to NITRO API, port 443. No agent is installed.
You need
NITRO user allowed to manage cert-key pairs, vserver bindings and system files, and to save the configuration.
Actions
Discovery, Installation, Verification, Rollback
Packages
netscaler-api 1.5.2
Note
  • Management TLS is verified by default. With netscaler-api 1.5.2 you can save a self-signed default certificate even when connecting to the NSIP by IP: run discovery, confirm the displayed SHA-256 fingerprint with the NetScaler administrator, and paste it into MANAGEMENT_TLS_PIN_SHA256 under Appliance discovery on the server page. Run discovery again to save it; deployment, verification and rollback use the same value. Only that exact certificate is accepted. A certificate change stops the connection with the expected and actual fingerprints; confirm the new certificate and save its fingerprint in the same field. MANAGEMENT_TLS_CA_BUNDLE takes a CA file and still checks the hostname; NETSCALER_TLS_CA_BUNDLE and NETSCALER_TLS_INSECURE remain aliases. MANAGEMENT_TLS_INSECURE disables verification when explicitly selected in the rule settings.
  • Discovery finds cert-key pairs, SSL vservers, bindings, the version and HA state. Rollback restores cert-key pairs, CA links and vserver bindings from the recorded deployment state and reports incomplete restoration.
  • netscaler-api 1.5.2 uses the server management address with an optional :port. IPv6 accepts the bare address, [address] or [address]:port. Without a port, discovery, deployment, verification and rollback use HTTPS 443.
  • Deployment stores recovery state in CERTOPS_BACKUP_DIR or the account’s .sslbrain/netscaler-backups. Backup paths are accepted on Alpine/musl too. Keep the backup until rollback is no longer needed.

Get started