6.5.10 Citrix NetScaler
Select the correct topology and configure key-based SSH access
CertKit provides separate NetScaler templates for a stand-alone appliance, an active/passive HA pair, and an active/active cluster. All three use SCP and SSH rather than the NetScaler REST API.
Choose the topology
| Template | Management target | Additional requirement |
|---|---|---|
| Citrix NetScaler (Single Host) | One appliance NSIP | SSH key authorized on that appliance. |
| NetScaler HA Pair (Active/Passive) | Either node’s NSIP | Agent can reach both NSIPs; key is authorized on both nodes. The template retargets to the current primary. |
| NetScaler Cluster (Active/Active) | Cluster management IP (CLIP) | Use a literal CLIP, not an NSIP; key is authorized on nodes that can become configuration coordinator. |
The HA and cluster templates are marked beta.
SSH requirements
- Windows OpenSSH client tools must be available on the agent host.
- Create a private key dedicated to CertKit and store it on the agent host.
- Add the public key to the NetScaler user’s authorized keys. For
nsroot, the standard location is/nsconfig/ssh/authorized_keys. - Set SSH private key path to the full path on the agent host.
The template restricts the private key file permissions to the agent identity before connecting.
Certificate-key pair behavior
Set SSL certkey pair name to the existing certkey under Traffic Management > SSL > Certificates. Renewals update that certkey in place, so existing virtual server, service, and Gateway bindings remain intact.
If the certkey does not exist, the template creates it. A new certkey serves no traffic until you bind it once in NetScaler.
The templates install and link intermediate certificates so the appliance serves the full chain. Routine renewals update certificate contents without changing bindings or chain links.
Topology troubleshooting
- An HA deployment must be able to reach both NSIPs even when the configured host is currently secondary.
- A cluster deployment must use the CLIP so the configuration coordinator propagates commands.
- Do not use the cluster template for a two-node HA pair; HA and clustering have different synchronization behavior.
For a product overview, see certificate automation for Citrix NetScaler.