NetScaler / Citrix ADC SSL certificate via ACME

Q: Do you use SSL cert-key bundle or classic SSL cert-key?

Both. Install-NetScalerCert.ps1 has an Auto mode that asks the appliance for its version and picks SSL cert-key bundle when the ADC version supports it and there is no existing classic cert-key with the same name. Older appliances and global VPN binding use classic SSL cert-key because bundles can only be bound to SSL vServers. Pass -DeploymentMode Classic to force the older method.

Q: Can I bind the certificate to multiple SSL vServers at once?

Yes. Use -vServerName "VS1,VS2,VS3" in the script parameters. The script binds the same certificate to every listed vServer and saves the configuration at the end.

Q: What about Citrix Gateway / global VPN binding?

Drop -vServerName and add -BindGlobalVpn . Global VPN binding always uses classic SSL cert-key (not bundles), so the script picks the correct format automatically.

NetScaler cannot fetch ACME certificates itself. simple-acme on a Windows server fetches the certificate and transfers it over the NITRO API.

How it works

Prepare the Windows server Extract the FairSSL edition of simple-acme to C:\simple-acme and install the CredentialManager module.
Create the NITRO user and AutoDNS Create an automation user on NetScaler, store its login in Windows Credential Manager, and create the CNAME to FairSSL AutoDNS.
Issue and install Run wacs.exe with the EAB keys. Install-NetScalerCert.ps1 transfers the certificate over the NITRO API and binds it to the chosen SSL vServer.
Check Under Traffic Management, SSL, Certificates in NetScaler's web UI, the new certificate must be uploaded and in use.

← All guides

NetScaler cannot fetch ACME certificates on its own. We use a Windows management server with simple-acme and a ready-made PowerShell script that pushes the certificate to NetScaler via the NITRO API. The whole flow, including renewals, runs without manual intervention.

Supported versions

Platform	Versions	Runs on	ACME client
NetScaler ADC	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + NITRO API, CredentialManager

How the setup is wired

✓ Windows Server (an existing management host works) runs simple-acme.
✓ simple-acme fetches the certificate from FairSSL via AutoDNS validation. No DNS API keys needed.
✓ Install-NetScalerCert.ps1 runs as an installation script and pushes the certificate to NetScaler over NITRO REST API on HTTPS.
✓ The script binds the certificate to one or more SSL vServers (or global VPN binding) and saves the configuration.
✓ simple-acme's daily scheduled task handles renewal when ARI or the 7-day fallback says so.

Setup

Step 1: Install simple-acme

Grab FairSSL's simple-acme build (pre-configured with the right ACME settings and ships Install-NetScalerCert.ps1 in the Scripts folder). Extract to C:\simple-acme. Install the CredentialManager module the script uses to look up credentials safely.

# PowerShell, Run as Administrator

Install-Module CredentialManager -Force -Scope CurrentUser

Step 2: Create a NITRO user on NetScaler

On NetScaler: create a dedicated automation user with NITRO permission to upload SSL files, create or update SSL cert-key pairs, bind certificates to SSL vServers and save the configuration. Store the credential in Windows Credential Manager on the management server.

$credential = Get-Credential -UserName "nsadmin" -Message "NetScaler NITRO user"
New-StoredCredential -Target "NetScaler-acme-user" -Credentials $credential -Persist LocalMachine

Step 3: Configure AutoDNS

In your FairSSL control panel: create a CNAME for _dnsauth.<your-domain> pointing at the FairSSL DNS server. One-time setup. See the full AutoDNS guide.

Step 4: Issue and deploy

Run the command from C:\simple-acme as administrator. Replace YOUR_NS_HOST, YOUR_ADC_CERTKEY_NAME and YOUR_VSERVER_NAME. If you are renewing a certificate already bound to a cert-key, use that name in -certName.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --host "ns.example.com" --validation none `
  --store pemfiles --pemfilespath "C:\simple-acme\Certificates" `
  --pemfilesname "ns-example-com" --friendlyname "fairssl-ns-cert" `
  --installation script --script ".\Scripts\Install-NetScalerCert.ps1" `
  --scriptparameters "-StorePath 'C:\simple-acme\Certificates' -FilePrefix 'ns-example-com' -nsHost 'YOUR_NS_HOST' -certName 'YOUR_ADC_CERTKEY_NAME' -vServerName 'YOUR_VSERVER_NAME' -CredentialTarget 'NetScaler-acme-user'"

Default is -DeploymentMode Auto, which picks SSL cert-key bundle on supported versions and classic cert-key otherwise. Use -DeploymentMode Classic if the appliance requires the older method.

Step 5: Common variants

Multiple vServers: use -vServerName 'VS1,VS2'
SNI bindings: add -SniCert
Citrix Gateway / global VPN: drop -vServerName and add -BindGlobalVpn
Trusted management certificate: add -ValidateManagementCertificate
HTTPS management is the default: -UseHttp exists, but only use it on an isolated management network because credentials and private key material are sent unencrypted.

Step 6: Verify

In NetScaler's web UI: check under Traffic Management > SSL > Certificates that the new certificate is uploaded and the selected SSL vServer or VPN binding uses it. If the service is public, run the hostname through FairSSL's SSL scanner.

Troubleshooting

Script cannot reach NetScaler management

The Windows server has to reach the NetScaler management address on TCP/443 (or TCP/80 if -UseHttp is set, which is not recommended). Check firewall rules, that the management address is reachable over HTTPS, and that the account can log in to the NITRO API.

NITRO returns 401 Unauthorized

The NITRO user stored in Credential Manager lacks privileges. The NetScaler account must be able to read the version and existing cert-key, upload system files, create and update SSL cert-key or SSL cert-key bundle, bind certificates to SSL vServer or global VPN, and save the configuration. Attach a command-policy that covers those NITRO operations.

Certificate uploads but is not bound

Check that -vServerName matches the exact SSL vServer name. Remember -SniCert if you are using SNI. For global VPN binding use -BindGlobalVpn instead of -vServerName.

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain renews and installs certificates on NetScaler

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Can Citrix NetScaler / ADC run ACME directly?

The ADC appliance itself does not fetch ACME certificates in this setup. We use a proxy approach: a Windows server issues the certificate via simple-acme and pushes it to NetScaler via the NITRO API. The same model is used for F5 BIG-IP, FortiGate (legacy), KEMP and many other appliances. If you have NetScaler Console with ACME or Zero Touch, that is a separate model not covered here.

Do you use SSL cert-key bundle or classic SSL cert-key?

Both. Install-NetScalerCert.ps1 has an Auto mode that asks the appliance for its version and picks SSL cert-key bundle when the ADC version supports it and there is no existing classic cert-key with the same name. Older appliances and global VPN binding use classic SSL cert-key because bundles can only be bound to SSL vServers. Pass -DeploymentMode Classic to force the older method.

Does the NetScaler management interface need to be open to the internet?

No. The Windows server running simple-acme only needs to reach the NetScaler management address over HTTPS. No public access required. FairSSL AutoDNS handles all ACME validation, so NetScaler exposes neither port 80 nor a DNS API.

What if NetScaler uses a self-signed management certificate?

The script accepts self-signed management certificates by default because that is the common case. Pass -ValidateManagementCertificate if the NetScaler management certificate is trusted by the Windows host and you want full TLS validation.

Can I bind the certificate to multiple SSL vServers at once?

Yes. Use -vServerName "VS1,VS2,VS3" in the script parameters. The script binds the same certificate to every listed vServer and saves the configuration at the end.

What about Citrix Gateway / global VPN binding?

Drop -vServerName and add -BindGlobalVpn. Global VPN binding always uses classic SSL cert-key (not bundles), so the script picks the correct format automatically.

What happens at renewal?

simple-acme schedules a daily task. When ARI or the built-in 7-day fallback triggers a renewal, a new certificate is fetched, Install-NetScalerCert.ps1 runs again and the certificate on NetScaler is swapped with no manual action.

Ready to automate NetScaler certificates?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates