--- title: "How to configure NetScaler" slug: "clm-configure-netscaler" updated: 2026-11-06T17:00:30Z published: 2026-11-06T17:00:30Z canonical: "docs.senhasegura.io/clm-configure-netscaler" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # How to configure NetScaler This document provides information on how to configure the **NetScaler** publishing profile so that it is possible to install and publish certificates on the server. During the **NetScaler** publishing profile configuration, it is possible to define the path for certificate storage, and you can bind the certificate with virtual servers, service groups, and services. If the NetScaler device has a Network Connector configured, the profile sends all NITRO API calls through it. It is also possible to configure the following options: - **SNI**: enables the use of multiple SSL certificates on the same IP address. - **OCSP**: performs real-time certificate validations that verify the certificate revocation status. - **CRL**: provides a list of revoked certificates, which is downloaded and stored in local cache, being updated periodically. ## Requirements The device must have an HTTPS connectivity for the NITRO API (`/nitro/v1/`). The default port is 443. Without it, the publication fails with the error `Equipment without HTTPS connectivity`. Attention After you save the device, reopen it and check that the HTTPS connectivity is still listed. Saving the device can remove its connectivities. ## Configure NetScaler To configure NetScaler, see the following steps: 1. On **Segura™ Platform**, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**. 2. In the side menu, select **Publishing** > **Publishing profiles**. 3. In the **Actions** button, select **NetScaler**. 4. In the **Settings** tab, enter the following information: 1. In the **Profile name ***, enter the profile's name. 2. In the **Credential username**, enter the credentials' name. 3. Optional: Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura™ Platform to be used. 5. Click **Continue**. 6. In the **NetScaler** tab, enter the following fields: 1. In the **File path to save the certificate** field, enter the repository path where the certificate will be stored. 2. Between the SSL services presented (**Virtual servers**, **Service groups**, and **Services**), add at least one service so the certificate can be bound to it. Info - The **Name** field in the **Virtual servers**, **Service groups**, and **Services** sections must have the same name registered in **NetScaler**. - If both **OCSP** and **CRL** options are enabled, **OCSP** will take precedence. - If the **OCSP** option is enabled, **SNI** will not work. 7. Click **Continue**. 8. In the **Devices** tab, select the **NetScaler** server. 1. The device must be previously registered in Segura® Platform. To route the publication through a Network Connector, configure one on the device before publishing. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment. 2. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured. 9. In the **Review** tab, review all information entered previously, and click **Save**. ## Verify your results Publish a certificate through the profile. If the device has a Network Connector configured, all NITRO API calls go through it. The execution log records which Network Connector handled the connection, in the format `Network Connector: senhasegura self-managed - <connector name>:<port>`. If the device has no Network Connector of its own, the profile falls back to the global Network Connector configured for the environment. After publishing, Segura® verifies the installation: it compares the SHA-256 hash of the certkey file on the NetScaler with the published certificate. If they differ, the publication fails. If the publication cannot connect to the NetScaler, check that the device's Network Connector agent is online and that the NetScaler answers on the port of the device's HTTPS connectivity. Info If a binding fails, for example because it already exists on the NetScaler device, Segura® records the failure in the execution log and continues the publication. ## Certificate names on the NetScaler - The certkey name is derived from the certificate's common name (CN): lowercase, with `.` replaced by `_` and `*` replaced by `wildcard`. For example, `*.example.com` becomes `wildcard_example_com`. - When the certificate is renewed, Segura® updates the existing certkey in place, so its bindings remain. - The certificate files are named `<cn>_<expiration date>_<hash>`, where `<hash>` is the first 8 hexadecimal characters of the certificate's SHA-256 fingerprint. - Segura® identifies the certificate by its fingerprint, not by its serial number. Attention Segura® does not link the intermediate certificate chain to the certkey. If your clients need the chain, link it on the NetScaler.