How to configure NetScaler

This document provides information on how to configure the NetScaler publishing profile so that it is possible to install and publish certificates on the server.

During the NetScaler publishing profile configuration, it is possible to define the path for certificate storage, and you can bind the certificate with virtual servers, service groups, and services. If the NetScaler device has a Network Connector configured, the profile sends all NITRO API calls through it.

It is also possible to configure the following options:

• SNI: enables the use of multiple SSL certificates on the same IP address.
• OCSP: performs real-time certificate validations that verify the certificate revocation status.
• CRL: provides a list of revoked certificates, which is downloaded and stored in local cache, being updated periodically.

Requirements

The device must have an HTTPS connectivity for the NITRO API (/nitro/v1/). The default port is 443. Without it, the publication fails with the error Equipment without HTTPS connectivity.

Configure NetScaler

To configure NetScaler, see the following steps:

1. On Segura™ Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the Actions button, select NetScaler.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credentials' name.
   3. Optional: Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura™ Platform to be used.
5. Click Continue.
6. In the NetScaler tab, enter the following fields:
   1. In the File path to save the certificate field, enter the repository path where the certificate will be stored.
   2. Between the SSL services presented (Virtual servers, Service groups, and Services), add at least one service so the certificate can be bound to it.
      Info

      • The Name field in the Virtual servers, Service groups, and Services sections must have the same name registered in NetScaler.
      • If both OCSP and CRL options are enabled, OCSP will take precedence.
      • If the OCSP option is enabled, SNI will not work.
7. Click Continue.
8. In the Devices tab, select the NetScaler server.
   1. The device must be previously registered in Segura® Platform. To route the publication through a Network Connector, configure one on the device before publishing. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all information entered previously, and click Save.

Verify your results

Publish a certificate through the profile. If the device has a Network Connector configured, all NITRO API calls go through it. The execution log records which Network Connector handled the connection, in the format Network Connector: senhasegura self-managed - <connector name>:<port>. If the device has no Network Connector of its own, the profile falls back to the global Network Connector configured for the environment.

After publishing, Segura® verifies the installation: it compares the SHA-256 hash of the certkey file on the NetScaler with the published certificate. If they differ, the publication fails.

If the publication cannot connect to the NetScaler, check that the device's Network Connector agent is online and that the NetScaler answers on the port of the device's HTTPS connectivity.

Certificate names on the NetScaler

• The certkey name is derived from the certificate's common name (CN): lowercase, with . replaced by _ and * replaced by wildcard. For example, *.example.com becomes wildcard_example_com.
• When the certificate is renewed, Segura® updates the existing certkey in place, so its bindings remain.
• The certificate files are named <cn>_<expiration date>_<hash>, where <hash> is the first 8 hexadecimal characters of the certificate's SHA-256 fingerprint.
• Segura® identifies the certificate by its fingerprint, not by its serial number.