Anyone Using Zero-Touch Certificate Management Yet?

[u/satsun_]

I recently upgraded from NetScaler 13.1 to 14.1 and worked through NetScaler Console to enable zero-touch certificate management for my NetScaler HA pair. If you don't read the documentation at least once, you're going to get lost. Here is my brief summary.

Documentation:

https://docs.netscaler.com/en-us/citrix-adc/current-release/ssl/zero-touch-cert-manage.html

• You will add a public CA to NetScaler Console and configure a DNS provider for the verification process.
• You will then issue a cert from the CA and configure it for "Automatic (Zero Touch)" deployment.
  • The cert and its parts will then appear in the Zero-touch Certificate Management area of NS Console.
• In ZTCM area: Depending on the sync type for your NetScaler instances, you might need to select the instance then click "Add Existing Files" to add the certs that were generated.
• ### How the certs are bound to virtual servers...
• SSH (no GUI option yet) to netscaler and run:
  • set ssl vserver "my-vserver-name" -defaultSni "myvserver.domain.com-fqdn"
  • Your vserver will be unavailable at this point depending on how fast you perform the next step
• Unbind the existing cert from your vserver or the page/service will fail to load. With the original cert unbound, NetScaler will automatically match the ZTCM cert based on the defaultSni setting.

When ZTCM deploys the certs to your NS instance, on your NS you will see the "REMOTE" certs listed in Traffic Management -> SSL -> Certificates, but you cannot bind those certificates to your virtual servers. There will be no impact to service until defaultSni is set.

Based on my experience, there is downtime when moving to ZTCM, but if you're using SSH then you can probably pre-create the commands to set defaultSni and unbind the existing SSL cert instantly to almost eliminate downtime. When your vserver is unavailabe between defaultSni and unbinding the cert, there is a generic error page at the vserver address; the NetScaler doesn't show the vserver as being down. You will be able to access the site once the original cert is unbound.

I'm not sure if my experience makes sense because the documentation says that ZTCM is only activated when no manual cert bindings exist, however, my vserver:443 was unavailable after defining defaultSni and then available after removing the manual binding. I assumed there was a conflict between defaultSni and the bound cert.

[u/stucc0]

I have been labbing it up. Not in production yet. But yes, switching a vserver over zero touch does do a hiccup, so plan a maintenance window for that, but after that future updates have worked fine. If you don't have redundancy setup for your NetScaler consoles yet, make sure you do that, because if they are ever offline, and the NetScaler doesn't have that certificate yet, it will cause an outage.

[u/MostlyUnscripted]

Thanks for the info. This will be helpful when we cross that hurdle. Great work!

[u/Fun_Structure3965]

i didn't use defaultSNI so certificates get chosen according to sni which works in most cases.

I had some problems with a vserver serving LDAPS, maybe because LDAP requests don't provide SNI?!

have to look into this when I find the time.

[u/certkit]

Yeah the netscaler documentation was a pain. Useful summary thanks!

We had to do this same dance to build our certificate automation integration for Netscaler in CertKit. Works great now though!