How to Install ACME SSL Certificates on Citrix ADC / NetScaler?

Getting an SSL/TLS certificate installed in the NetScaler or Citrix ADC system doesn’t have to be a time-consuming process. The Automated Certificate Management Environment (ACME) protocol makes it possible to manage certificate issuance and renewal automatically. Depending on the deployment architecture used, it is also possible to automate the installation of renewed certificates as well.

There are two main approaches that can be followed:

The first uses the integrated ACME client in the NetScaler console to run the certificate issue and renewal;

The second approach involves running the external ACME client on a Windows management server. The API, known as NetScaler NITRO, can also be utilized to upload and bind the certificates automatically.

This guide explains how the ACME protocol works with NetScaler and Citrix ADC, how to provide the steps of ACME certificate installation, and how to conduct automatic certificate renewals.

What is an ACME SSL Certificate Installation Process on the NetScaler?

The term ‘ACME’ stands for the protocol employed for the automated exchange of information between the ACME client and the Certificate authority (CA).

The ACME protocol allows users to make requests for approval, issue, and renew SSL certificates with minimum manual input.

• NetScaler Console-based Automation, where NetScaler Console manages the ACME lifecycle and certificate renewal.
• External ACME Automation, where an ACME client runs on a separate Windows management server and deploys certificates to NetScaler through the NITRO API.

Key events are consistent regardless of the working environment; however generally the working flow remains:

ACME Client → Certificate Authority → Domain Validation → Certificate Issuance →  NetScaler Deployment → Automated Renewal.

Using this method, administrators will not need to supervise the expiry dates of every certificate and repeat the process of certificates uploading.

What Is the Process of ACME Certificate Installation in NetScaler and Citrix ADC?

In general, the lifecycle of ACME certificates proceeds through many stages.

The very first step is that the ACME client contacts the chosen Certificate Authority requesting a certificate. The CA will require the proof of control over the requested domain.

In the case of acting according to the DNS method, the CA generates the challenge in the form of a particular DNS TXT record, while the ACME automation system creates such a record using the DNS provider.

Once the CA has validated the record, it provides the certificate. Once this is done, it can be stored as well as deployed to the NetScaler.

Using the NetScaler Console, the platform can manage the ACME workflow and automate the process of deploying the renewed certificate in case of using Zero-touch Certificate Management.

In case there is an external ACME client, the certificate can be saved locally and then passed to the PowerShell installation script that would be able to perform the upload, creation, modification and binding of the certificate using the NetScaler NITRO REST API.

The workflow is as follows:

Certificate Request → DNS-01 Validation → Certificate Issuance → Certificate Storage → NetScaler Upload → Certificate-Key Pair Update → SSL vServer Binding → Configuration Save

Once the configuration is correctly applied, the same process will be repeated each time, whenever the certificate is in its renewal period.

Which ACME Approach Should You Use for NetScaler?

The choice of architecture is influenced by the nature of the management of the NetScaler setup.

Can NetScaler Console Handle ACME Certificates Directly?

Certainly. NetScaler Console has ACME capabilities and enables automated issuance and renewal of certificates. It has an ACME client and is compatible with a number of Certificate Authorities and DNS providers.

In this option, the administrator needs to configure the CA and select certificates that need to be renewed automatically, as well as pair domain names with their corresponding DNS providers. After that, NetScaler Console will do the renewal himself.

This option is beneficial when you want to keep awarding the certificates in the same way as it is done on the NetScaler Console.

Can You Use an External ACME Client with NetScaler or Citrix ADC?

Yes. A Windows management server can run an external ACME client and independently get the certificates from the NetScaler.

Once the certificate has been obtained, a PowerShell script can invoke the NITRO API to:

• Upload the files with the certificates
• Add or update the certificate-key pairs
• Add or update the certificate-key bundles
• Bind the certificates to SSL vServers
• Bind the certificates globally for VPNs
• Save the configuration of the NetScaler

This solution is good for the organizations which already have the Windows management server with them or want to create the unique workflow for their certificate automation.

Prerequisites

Prior to finalizing ACME automation, it is necessary to set up relevant infrastructure. The common requirement list includes:

• A Citrix ADC or NetScaler appliance
• NetScaler management console access
• ACME Certificate Authority
• ACME software client
• Valid ACME account if required
• Following External Account Binding requirements for the CA
• DNS service provider access through a dedicated DNS service
• Correct DNS settings
• Dedicated NetScaler automation account when API NITRO technology is used
• Network connectivity between automation and NetScaler

If you use NetScaler Console, you will also need the access credentials for your DNS service provider and the right configuration for NetScaler Console.

If you are using an external Windows solution, the management server has to reach NetScaler over HTTPS.

How Do You Configure the Certificate Authority for ACME?

As the first step of an implementation based on NetScaler Console, the Certificate Authority has to be configured first. To add a CA vendor in SSL management of NetScaler Console, details required for the CA are to be filled based on what the CA requires.

• CA name
• Contact email address
• ACME Directory URL
• EAB credentials, if required
• Automatic renewal window

The renewal window indicates how early before the certificate expiration, the automated renewal will start.

After saving the CA configuration, the NetScaler Console tries to connect to the CA for validation. If the connection fails, make sure to examine the URL of the ACME Directory, account information, network connection, and configuration values.

It may also be necessary to set up multiple CAs when working with certificates produced by different companies.

Configure DNS-01 Validation for ACME

DNS-01 is essential in the process of Certificate issuance and renewal.

During the validation process, CA sends a challenge value once again. The ACME automation solution makes a TXT record in the DNS zone of the domain.

The CA checks the TXT record confirming control over the domain.

The steps are as follows:

CA Challenge → TXT Record Creation → CA Validation → Certificate Issuance

While using the NetScaler Console, the administrator configures the DNS provider that is supported and enters the desired credentials. After that, he has to map each certificate domain to the corresponding DNS provider.

For instance, if the domain is hosted on the Amazon Route 53 service, the administrator can configure the relevant Route 53 credentials and map the corresponding domain in this DNS provider.

When a certificate is issued or renewed, the ACME process will create the required TXT record automatically.

It is essential that every domain associated with a certificate is mapped properly. If there are several domains included in one certificate, but one of them cannot be verified, then the certificate will not be issued or renewed.

Can You Use DNS Delegation Instead of DNS API Credentials?

Yes. An external ACME system can use DNS delegation for easy validation.

For instance, an organization can create a CNAME record for DNS validation – for example, _dnsauth.example.com

The record may indicate the DNS service which is managed by the provider offering certificate automation.

This approach allows eliminating the need to share DNS provider API credentials with the ACME client. There is only one time needed for DNS delegation setup while the outside ACME service is responsible for handling the validation records.

This approach might be helpful for organizations that want to limit the number of DNS API credentials kept inside the certificate management server.

How Do You Select Certificates for Automatic Renewal?

Once the CA has been set up using the NetScaler Console, the application will know what certificates are related to the CA.

The administrator can choose which certificates will be subject to the automated renewal process.

Certificates can also be:

• Added to the automated renewal.
• Omitted from automatic renewal.
• Changed to manual renewal.
• Returned from manual renewal back to automated renewal.

Thus, it is possible to use a combination of automatic and manual types of certificate management depending on the needs of the organization.

Make sure that you do not have the same certificate saved in two different certificate stores as it may lead to issues in the renewal process.

Steps to Install an ACME SSL Certificate on NetScaler

The exact installation process depends on the architecture.

Option 1: Install an ACME Certificate Through NetScaler Console

In a NetScaler Console-based workflow, administrators can request a new certificate directly through the SSL management interface.

The process generally involves:

• Open the SSL dashboard.
• Start a new certificate issuance request.
• Choose whether to generate a new CSR or upload an existing CSR.
• Select or generate the required private key.
• Enter the certificate and CSR information.
• Select the Certificate Authority.
• Select the DNS provider.
• Select the certificate deployment mode.
• Enable automatic renewal if required.
• Submit the request.

The certificate can either go into the standard Certificate Store or into the Zero-touch Store.

Certificates in the standard Certificate Store must be manually deployed to NetScaler after a renewal, while certificates under the Zero-touch Store can be deployed automatically without administrative involvement.

As a result, the organizations looking for complete automation need to opt for Zero-touch deployment workflow wherever it is compatible.

Option 2: Use an External ACME Client to Install the Certificate

In external automation, the ACME client resides in the Windows management server.

The workflow in this kind of deployment is as follows:

Windows Server → ACME Client → Certificate Authority → Certificate Files → PowerShell Script → NITRO API → NetScaler.

First, ACME client generates and acquires a certificate and stores it in a file format in the directory.

Next, the installation script launches NITRO REST API and connects it to NetScaler.

In the course of performing the operation, the script can upload a certificate, create or modify corresponding certificate-key object, bind it to the SSL vServer and safeguard the configuration.

Configure NITRO API Access for Certificate Automation

When using an external ACME client, create a dedicated automation account on NetScaler.

The account should have only the permissions required for certificate deployment.

Depending on the deployment workflow, the account may need permission to:

• Read the NetScaler version
• Read existing certificate-key objects
• Upload certificate files
• Create certificate-key pairs
• Update certificate-key pairs
• Create or update certificate-key bundles
• Bind certificates to SSL vServers
• Bind certificates for global VPN
• Save the configuration

Use a dedicated command policy to limit the account to the required operations.

Avoid using a full administrative account when a more restricted automation account is sufficient.

How Should You Store NetScaler Automation Credentials?

It is important to ensure that credentials used in the deployment script are kept secure.

In the case of Windows automation, it is possible to save credentials to Windows Credential Manager for the PowerShell deployment script to call upon when necessary.

This is a much safer approach than putting login information directly into the script or command parameters.

The automation server should also use the right filesystem permissions to secure any private key files and certificates.

Should You Use HTTP or HTTPS for NITRO API Communication?

HTTPS should be the method used whenever possible to ensure communication between the automation server and NetScaler.

While NITRO API works over HTTP in some cases, it does become a risk because of potentially transmitting sensitive information over a non-encrypted channel.

In this regard, if HTTP is used, it should only be over a closed management network.

If for any reason it is needed to rely on HTTP, therefore, use HTTPS in production environments and when possible, achieve NetScaler management certificate validation.

Bind an ACME Certificate to an SSL vServer

Uploading a certificate is only one part of the installation process.

The certificate must also be associated with the appropriate SSL service.

For an SSL vServer, the deployment workflow typically performs the following actions:

• Upload the certificate and private key.
• Create or update the certificate-key pair.
• Identify the target SSL vServer.
• Bind the certificate to the vServer.
• Save the NetScaler configuration.

The vServer name must correspond to the specific entity configured on the NetScaler.

If the certificate is used in an SNI configuration, the deployment procedure must take into account the SNI certificate binding. When multiple SSL vServers are present in the same environment, the same certificate can be utilized on various vServers as necessary.

Steps to Deploy an ACME SSL for Citrix Gateway or Global VPN

Citrix Gateway installations may require a global VPN certificate binding rather than a standard SSL vServer binding.

In an external NITRO-based implementation, the automated script may be configured to use global VPN binding instead of individual SSL vServer binding.

The precise option for deployment is determined by the configuration of the NetScaler device and the replacement certificate.

How Does Automatic Certificate Renewal Work?

After the initial certificate has been installed, the renewal process will run automatically.

In the NetScaler Console version, the system constantly checks the validity of the certificate, after which the renewal is initiated once the designated renewal period has arrived.

In an external implementation of ACME, scheduled tasks of the ACME client perform periodic checks as to whether the renewal of certificates is necessary. The information on renewal obtained from the CA or backup renewal period can be used by the client.

Thus, the automated process will work as follows:

Renewal Window Reached

↓

ACME Client Requests Renewal

↓

CA Issues DNS-01 Challenge

↓

DNS TXT Record Is Created

↓

CA Validates Domain Ownership

↓

Renewed Certificate Is Issued

↓

Certificate Is Stored

↓

Deployment Script Runs

↓

Certificate Is Uploaded to NetScaler

↓

Certificate-Key Pair Is Updated

↓

Certificate Is Rebound

↓

Configuration Is Saved

This is what makes the process fully automated rather than simply automating certificate issuance.

Does Automatic Certificate Renewal Also Deploy the New Certificate?

Not necessarily.

This is an important distinction.

A certificate can be successfully renewed but still require deployment to the production appliance.

With NetScaler Console, the deployment behavior depends on the certificate store.

• Certificate Store: The renewed certificate may require manual deployment.
• Zero-touch Store: The renewed certificate can be automatically deployed to NetScaler.

With an external ACME client, deployment depends on the installation script and NITRO API integration. If the deployment script runs successfully after renewal, the certificate can be automatically uploaded and bound.

Therefore, organizations should verify both stages:

Certificate Renewal + Certificate Deployment

Automating only the first stage does not eliminate all operational work.

Verify an ACME Certificate Installation

After installation or renewal, verify the certificate from the NetScaler management interface.

Check that:

• The certificate appears in the certificate inventory.
• The certificate-key pair is present.
• The correct expiration date is displayed.
• The certificate is bound to the intended SSL vServer.
• SNI bindings are correct where applicable.
• Citrix Gateway or global VPN uses the correct certificate when applicable.
• The certificate chain is complete.
• The configuration has been saved.

For public-facing services, use an external SSL/TLS testing service to verify that the correct certificate is being presented to clients.

What Happens If a Domain Is Not Mapped to the Correct DNS Provider?

ACME validation can fail if the DNS provider mapping is incorrect.

For example, if a certificate contains:

• example.com
• www.example.com
• app.example.com

each domain must be correctly handled by the configured DNS validation system.

If the ACME client cannot create or validate the required TXT record, the CA cannot confirm domain ownership. As a result, the certificate cannot be issued or renewed.

If a domain is removed from its DNS provider mapping, automated renewal may stop.

DNS mappings should therefore be reviewed whenever DNS hosting changes.

Most Common ACME NetScaler Installation Problems

Why Can the Automation Server Not Reach NetScaler?

Check:

• Firewall rules
• TCP/443 connectivity
• NetScaler management address
• HTTPS accessibility
• NITRO API availability
• Network routing

The Windows management server must be able to reach the NetScaler management interface.

Why Does NITRO Return a 401 Unauthorized Error?

A 401 error generally indicates an authentication or authorization problem.

Check that:

• The stored credentials are correct.
• The automation account exists.
• The account is active.
• The account has the required permissions.
• The command policy allows the required NITRO operations.

Why Was the Certificate Uploaded but Not Bound?

Check the target SSL vServer name carefully.

The name provided to the deployment script must match the exact NetScaler object name.

For SNI deployments, verify that the appropriate SNI certificate option is enabled.

For Citrix Gateway or global VPN deployments, ensure that the correct global binding method is being used.

Why Did ACME Fail to Create the DNS TXT Record?

Check:

• DNS provider credentials
• DNS provider availability
• Domain mapping
• DNS delegation
• TXT record permissions
• ACME client configuration

The DNS provider must be supported by the selected ACME automation method.

Why Did the ACME Client Fail to Contact the CA?

Check:

• ACME Directory URL
• Network connectivity
• Firewall rules
• CA account configuration
• EAB credentials
• System time synchronization

An incorrect ACME Directory URL or invalid account configuration can prevent the client from completing the ACME order.

What Are the Security Best Practices for ACME NetScaler Automation?

Organizations should follow several security practices when automating certificate installation.

Use HTTPS

Use encrypted communication between the automation server and NetScaler.

Use a Dedicated Automation Account

Create a dedicated NITRO user instead of using a general administrator account.

Apply Least Privilege

Grant only the permissions required for certificate deployment.

Protect Private Keys

Restrict access to certificate and private key files stored on the automation server.

Protect ACME Credentials

Secure EAB credentials, API credentials, and other sensitive values.

Secure DNS Credentials

If the ACME client directly manages DNS, protect DNS API credentials carefully. DNS delegation can be considered when appropriate.

Monitor Renewal and Deployment

Certificate renewal should be monitored independently from certificate deployment. A successful ACME renewal does not necessarily guarantee successful installation on NetScaler.

What Are the Benefits of ACME SSL Automation for NetScaler?

Automating the NetScaler certificate lifecycle provides several benefits.

Reduced Manual Work

Administrators no longer need to manually track certificate expiration dates and repeat the same renewal process.

Lower Risk of Expired Certificates

Automated renewal reduces the possibility of certificates expiring unnoticed.

Faster Certificate Deployment

Certificates can be installed and bound automatically after issuance or renewal.

Consistent Operations

The same deployment workflow can be repeated across certificates and environments.

Better Security

Automated renewal helps maintain valid certificates and reduces the need to reuse long-lived certificates.

Reduced Operational Overhead

IT teams spend less time performing repetitive certificate management tasks.

What Is the Best Way to Automate SSL Certificates on NetScaler?

Your NetScaler architecture will dictate which approach you should follow.

For example, organizations that use NetScaler Console and seek integrated certificate lifecycle management can leverage the built-in ACME process to automate certificate issuance and renewal. Zero-touch Certificate Management feature will enable them to utilize automated deployment options wherever possible.

For organizations that prefer centralized management of certificates, they can install and operate an ACME client on a Windows management server, obtain certificates and utilize PowerShell and NITRO API to bind the certificates to NetScaler.

In both situations, the main principle is to automate the whole certificate lifecycle instead of just automating the certificate renewal process.

The proper workflow is:

Request → Validate → Issue → Renew → Deploy → Bind → Monitor

The combination of ACME automation with proper DNS validation, credential management, NITRO API compliance, and certificate deployment would allow NetScaler and Citrix ADC to work with valid SSL and TLS certificates with as little manual work as possible.

Conclusion

By utilizing an appropriate SSL certificate and implementing ACME automation, you will no longer have to search for impending expiration dates or keep performing repetitive installation manually in order to keep the NetScaler architecture safe.

Purchase an Affordable ACME SSL certificate from Certera and enjoy a simplified certificate management process with effective SSL solutions developed to secure your websites and applications.