Citrix Netscaler VPX (10) Loadbalancer- CSR Instructions

To generate a Certificate Signing Request (CSR) for Citrix Netscaler, a key pair must be created for the server.

These two items are a public key and a private key pair and cannot be separated. Like all key pairs the private key once created will remain on the system where the CSR is made. The CSR public key is what you will submit to a Certificate Authority (CA) to get the public key signed.

To generate a CSR on Citrix Netscaler 10 & 10.5 perform the following.

Step 1: Generating your private key:

1. Log on to the NetScaler appliance.
2. Under the Configuration tab select SSL in the navigation pane.
3. Under SSL Keys click Create RSA key.
   
4. Under Key Filename* specify the file name to your private key file.
   Note: If you click browse you can choose the location and file path you want this private key file saved. The default directory is /nsconfig/ssl. This is the private key you will generate your CSR from.
5. Under Key Size (bits)* specify 2048 bits.
6. Ignore Public Exponent Value*.
7. Select PEM.
8. Under PEM Encoding Algorithm Select the algorithm (DES or DES3) that you want to use to encrypt the RSA key.
   Note: If you leave this box blank, you are not required to enter a passphrase.
9. Under PEM Passphrase* specify a password to protect your private key.
   Note: You will need to remember this passphrase for CSR creation and later installation of the server certificate after it has been issued.
10. Verify your passphrase.
11. Click Create.
    

Step 2: Creating your CSR:

1. Back in Configuration > SSL and under SSL Certificates Click Create Certificate Request.
   
2. In the Create Certificate Request page window, under Request File Name specify the filename of your CSR file.
   Note: If you click browse you can choose the location and file path you want this CSR file saved. The contents of this file is what you will copy and paste into the enrollment field when getting an SSL/TLS certificate.
3. In the Key File Name field click Browse and select the private key file you created in Step 1.
4. Under key format select PEM.
5. Under PEM Passphrase enter a passphrase if you created one in Step 1.
   Note: If you did not associate a pass phrase with your key during step 1 then you can ignore this.
6. In the Distinguished Name Fields specify the information as it applies to your organization.
   • Country: In the drop-down list, select the country where your company is legally located.
   • State or Province: Enter the state or province where your company is legally located.
   • Organization Name: Enter your company’s legally registered name.
   • City: Enter the city where your company is legally located.
   • Email Address: (Optional) You can leave this box blank.
   • Organization Unit: Enter the department within your organization that you want to appear on the SSL Certificate.
   • Common Name: Enter the fully qualified domain name (FQDN) For example: www.yourdomain.com
7. Under the Attribute Fields
   • Challenge Password: Ignore this option. Associating a passphrase to your CSR will encrypt it and you will be unable to enroll with this during submission to a CA.
   • Company Name: (Optional) Enter your company name.
8. Click Create.

You have created your private key and CSR.

Step 3: Retrieving your CSR for enrollment:
Typically you will see a green heading after your CSR has been created for easy retrieval. You can also pick it up by the following… Alternatively you can always go to the file & location where you saved this CSR file.

1. Return to the NetScaler console, on the Configuration tab, in the tree menu, expand Traffic Management and then click SSL.
2. Under Tools, click on Manage Certificates / Keys / CSRs, select your CSR or request file (i.e. www.yourdomain.csr) and then click View.
3. In the your “CSR” window, copy the entire CSR code, including the —–BEGIN NEW CERTIFICATE REQUEST—– and —–END NEW CERTIFICATE REQUEST—– tags.
   Note: The default directory is /nsconfig/ssl. You will paste the contents of this file into your enrollment portal.

Congrats you have just created a Citrix key, and a CSR for your Citrix system.

If you are unable to use these instructions for your server, Acmetek recommends that you contact either the vendor of your software or the organization that supports it.

Citrix Support:
For more information refer to Citrix.

For Citrix Netscaler 10+ SSL/TLS install instructions click here