- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
NetScaler UI Guide
This section shows how to use the NetScaler pages in CertSecure: finding the agent, adding the certificate-key pairs CertSecure should manage, renewing them manually or automatically, and checking tasks.
Where to Find It
- Open the left navigation menu.
- Under Utilities, click Integrations.
- On the Integrations page, click the Load Balancers tab, and then the NetScaler tile.
| Item | What it shows |
|---|---|
| Agent Name | The name of the agent, set by NAME in its conf.ini. Each agent manages one NetScaler. |
| IP Address | The IP address registered for the agent. |
| Type | Citrix, for a Citrix NS Agent. |
| Tag | The tag the agent is grouped under (RENEWAL_AGENT_TAG in conf.ini). Change it with Update Tag. |
| Status | Online while the agent is checking in; Offline otherwise. A scheduled renewal is skipped while the agent is offline. |
| Renewal Period | How many days after a certificate is issued automatic renewal renews it. The default is 200. Change it with Update Renewal Period. |
| CSR Info > View Details | The certificate-key pairs registered on the agent and the certificate details saved for each. |
| Automation Status | The switch that turns automatic renewal on or off for this agent. |
Agent Actions
Right-click an agent to see the actions shown in the screenshot above:
- View CSR Details – shows the certificate-key pairs registered on the agent and the certificate details saved for each. Nothing can be changed here.
- Renew – renews one or more pairs, now or at a scheduled time (see Renewing a Certificate-Key Pair).
- Update CSR Details – adds or removes certificate-key pairs, and enters or changes the certificate details of each pair (see Adding Certificate-Key Pairs).
- Update Renewal Period – sets how many days after issue a certificate is renewed automatically (see Turning On Automatic Renewal).
- View Tasks – opens the task history of this agent.
- Delete – removes the agent from CertSecure after a confirmation prompt. Nothing is changed on the NetScaler.
Adding Certificate-Key Pairs
CertSecure renews only the certificate-key pairs you register on the agent. Each pair must already exist on the NetScaler, under the same name (see NetScaler Requirements).
- Right-click the agent and choose Update CSR Details.
- Click Add Certificate-Key Pair and enter the Pair Name exactly as it appears in show ssl certKey on the NetScaler.
- In the list, click Update details next to the pair (Add details if its details have not been saved yet), and fill in the fields below.
- Repeat for every pair this agent should manage.
| Field | Applies to | What it means |
|---|---|---|
| Certificate Authority | Required | The CA that issues the renewed certificates for this pair. |
| Certificate Template | Required | The template to request from the selected CA. Options depend on the CA chosen. |
| Organization ID | Only when CA = DigiCert | The DigiCert organization to request the certificate under. |
| Order Validity | Only when CA = DigiCert | How many days the requested certificate should be valid for. |
| Common Name | Required | The common name of the certificate. Keep the name of the certificate the pair holds now; the NetScaler rejects an update when the domain changes. |
| Key Length | Required | The size of the new RSA key. |
| Organization, Organization Unit, City | Required | Chosen from the lists. |
| State | Required | The state or province, written out in full. |
| Country Code | Required | The two-letter ISO country code, for example US or CA. |
| DNS | Optional | DNS names to include in the certificate, separated by commas. |
| IP Address | Optional | IP addresses to include in the certificate, separated by commas. |
| Optional | Email addresses to include in the certificate, separated by commas. | |
| Watchers List | Required | The email addresses of the people to notify about this certificate. |
Delete next to a pair removes it from the agent, so CertSecure no longer renews it. The certificate-key pair on the NetScaler is not changed.
Renewing a Certificate-Key Pair
- Right-click the agent and choose Renew.
- Choose Renew Now, or choose Schedule Renewal and pick the date and time.
- In Select Certificate-Key Pairs, select one or more pairs.
- Click Renew. Each selected pair gets its own renewal task.
Before you renew:
- The certificate details of the pair must be saved. Otherwise the renewal fails with Certname <name> has no certificate information.
- The Pair Name must match a certificate-key pair on the NetScaler exactly.
- The agent should be Online. A scheduled renewal is skipped while the agent is offline.
What the agent does next is described in Workflow Steps under NetScaler Workflow.
Turning On Automatic Renewal
- Right-click the agent, choose Update Renewal Period, and enter how many days after issue a certificate should be renewed. The default is 200 days.
- Turn on the Automation Status switch in the agent's row.
The agent then checks its pairs every 12 hours and renews each one when it is due. Automatic Renewal under NetScaler Workflow explains how it decides.
Viewing Tasks
- Right-click the agent and choose View Tasks.
- Use the column filters or Refresh to find a task.
- Each renewal of a pair is its own task. The Details and Status columns show the progress or the failure reason.
- A task ends with OK when the pair was updated, or ERROR when the renewal failed. Renewal Errors under NetScaler Troubleshooting lists the common messages.
Good to Know
- One agent per NetScaler. Register a Citrix NS Agent for each appliance you manage.
- Only registered pairs are renewed, and each one must already exist on the NetScaler under the same name.
- Bindings are kept. The agent updates the existing certificate-key pair, so every virtual server or service bound to it keeps its binding.
- Set the Renewal Period before turning on automation, so the agent knows how early to renew.
- Scheduled renewals need the agent Online at the scheduled time.