Sometimes you may need SSL certificate just for testing your (local) web application. Of course, for public and trusted purposes, you’ll probably use free Let’s Encrypt certificate or something similar (or, of course, any of the paid options).
And this is OK as long as you have publicly resolvable domain name.
But what if you need certificate for, let’s say, “localhost” or “webserver.local”?
Then you’ll probably use your internal PKI infrastructure or a simple self-signed certificate.
So, you’ve finally decided to make yourself “a small Citrix lab” (XenMobile and NetScaler), but you’re having trouble with getting all the certificates in place. Fear not, I’m here to help!
Installing the SSL certificates for NetScaler is relatively simple, but still… some steps are easily forgotten and then… you need to troubleshoot.
Steps to install the SSL certificate for NetScaler (correctly) are:
Install the server certificate (for example, certificate for xms.yourdomain.com). The easiest way is to use .PFX certificate file, and you can install it through Traffic Management – SSL – Certificates – Server Certificates.
Install the issuing and root CA’s certificates (.PEM files are OK) through Traffic Management – SSL – Certificates – CA Certificates.
Create link (right click – Link) between the server certificate and issuing CA’s certificate.
Create link (right click – Link) between the issuing CA’s certificate and root CA’s certificate.
Check the certificate links on issuing CA’s certificate (right click – Certificate links). There should be two – one linking the server certificate, another the root certificate.
Select the imported certificate for NetScaler Gateway usage.
Select the imported certificate for (SSL) virtual servers as well. If you’re using NetScaler appliances in HA mode, force synchronization.
For XenMobile Server, there is some preparation work to do, to get it all right. Basically, you’ll need to combine all the (.PEM) certificate files into one, upload that to XenMobile Server, and restart.
Combine individual (.PEM) certificate files (server, issuing and root CA) into one .PEM file by following instructions on this DigiCert site (you can use Notepad to achieve this). Your final .PEM file should look like this: